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ABSTRACT 


This study was a pre-phase A study initiated under NASA contract by JPL 
to investigate the safety implications of Space Shuttle launched spacecraft 
that use liquid fluorine as the oxidizer for spacecraft propulsion. 

The reference spacecraft, for study purposes, was similar to a MJS 77* 
Mariner in configuration. 

Fluorine based retropropulsion will be needed in the future to effectively 
conduct a number of planetary orbiter missions particularly those to outer 
planets. Technically, the concern for Space Shuttle launched spacecraft 
consists of safely loading, transporting and carrying into space a tank contain- 
ing typically 1000 pounds of liquid fluorine which is a cryogenic, toxic, and 
potentially corrosive fluid. 

Feasibility of safe operation was investigated and the equipment and 
procedures necessary to maximize the chance of success determined. Hazards to 
the Shuttle were found to be similar in kind if not degree to those encountered 
in use of nitrogen tetroxide (also a toxic oxidizer). It was concluded that 
residual risks from spacecraft using fluorine and nitrogen tetroxide oxidizers 
during ground and flight handling may be reduced by isolation of the oxidizer 
to only its tank. Operation of planetary spacecraft propulsion in the vicinity 
of the Shuttle in earth orbit is not required. Proper recognition of the 
characteristics of both of these oxidizers must be given in spacecraft design 
and in ground and flight operations. Safety precautions appropriate to payloads 
carried in manned vehicles were developed in the study. 

The primary hazard to personnel was identified as propellant loading 
operations which are very similar in nature to routine transfers from the truck 
trailers used during delivery of fluorine to industrial users. These operations 
should be accomplished in an area reasonably remote from personnel and facilities 
concentrations. 

Transportation and installation of the loaded propulsion system involve 
hazards second only to loading propellant where great care must be exercised. 
Clearing the pad during spacecraft mating with the Shuttle Orbiter is recommended. 

*Mariner Jupiter Saturn designated for launch in 1977 
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The considerations relating to transport of the spacecraft bipropellant 
propulsion systems considered here have much in common with carrying of other 
propulsive payloads such as monopropellant hydrazine systems, and the OMS kits 
which utilize NgO^/MMH. The selection of solid propellant for the IUS would 
appear to eliminate the hazard of propellant leakage from the IUS. 

Residual hazards during flight in the Shuttle cargo bay from a propulsion 
system which has been subjected to propellant loading, storage, transportation 
and installation in the Orbiter appear low. It is important, however, that 
hazards to the propulsion system from the failure of other systems also in the 
cargo bay are minimized. 

To maximize the probability of success, basic work should be continued and 
expanded with goals delineated to be matched against specific criteria. 


FOREWORD 


The principal purpose of this study was to ascertain the more im- 
portant effects on the Space Transportation System (STS) when liquid 
fluorine (LF^) is transported on the STS as part of a Shuttle-launched 
spacecraft. The study might best be categorized as a pre-Phase A study. 
Planetary orbiters will probably require bipropellant systems, so it 
was clearly desirable to study the effects attendant with a space- 
storable propellant such as LF 2 as compared to an earth-storable propel- 
lant. The oxidizer selected for comparison with fluorine was nitrogen 
tetroxide (N 2 0 4 ), because it is an acceptable oxidizer for transport on 
the Shuttle. 

The second purpose was to evaluate, on the basis of these effects, 
the feasibility of carrying fluorine as part of a Shuttle payload. There 
is always a risk to Shuttle from carrying any oxidizer or high pressure 
gas. The basis for judgment was whether or not the risks associated with 
a propulsion system containing fluorine could be reduced to the level of 
one containing NgO^. The comparison method (LF 2 versus N 2 0 4 ) was used 
throughout the study to give it the proper perspective since some type 
of oxidizer is normally required for the propulsion system of a planetary 
orbiter spacecraft. 

The study begins with the loading of the spacecraft propulsion 
system at ETR and concludes with deployment of the IUS/Tug, and it also 
considers Shuttle abort modes. 


The scope of the present study tended to broaden as It progressed, 
and the initially budgeted effort was not large enough to examine a 
number of interesting areas. The question of whether or not to dump 
propellant in case of abort, for example, could not be resolved within 
the resources available, so an arbitrary choice to assume dump would be 
required was made for purposes of conservatism in continuing the study. 


The uncertainty surrounding the selection of the Interim Upper Stage 
until just before the study ended precluded an evaluation of some 
of the effects on that vehicle. Thus, the emphasis is on interfaces 
between the Shuttle Orbiter and the spacecraft propulsion system, with 
a dump provision conservatively assumed. 

To answer the question, "What is required to prove that fluorine 
can safely be used as an oxidizer in Shuttle-launched spacecraft?" 
requires that specific and detailed configuration of spacecraft, IUS/ 

Tu^ and Orbiter be known. The present study necessarily addresses this 
question from a more general point of view. No unique technical problems 
were found that could not be resolved. 

In view of this result, it is concluded that with proper design of 
flight and ground support hardware, adequate test and operations pro- 
cedures, and thorough training of personnel , the hazards associated with 
fluorine can be reduced to a level equivalent to that of nitrogen 
tetroxide. 


A. N. Williams 

Liquid Propulsion Section 

Jet Propulsion Laboratory 


D. L. Young 

Li quid Propulsion Secti on 
Jet Propulsion Laboratory 
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1 . INTRODUCTION 


1.1 SCOPE AND PURPOSE 

The Space Shuttle or Space Transportation System (STS) will introduce 
a new era in transportation, the era of routine flights and operations on 
orbit. Much creative energy, imagination and financial support have gone 
into the design of the Shuttle system, beginning with conceptual design 
and sizing, through the more detailed design work now in progress. Now 
that the capabilities of the STS are known, potential users such as the 
spacecraft community are investigating how best to utilize these cap- 
abi 1 tti es . 

There are a number of missions of great interest which involve the 
orbiting of Mariner class spacecraft around the outer planets. Representa- 
tive spacecraft for these missions are shown in Figures 1-1 through T-3. 

In order to accomplish these missions, consistent with anticipated Shuttle 
Upper Stages (SUS) and with reasonable flight times, it has been found 
cost effective in many cases to utilize the high level of spacecraft 
planetary retro-propulsion performance that can only be obtained with 
fluorine containing oxidizers such as liquid fluorine or fluorine-oxygen 
mixtures.* 

One aspect of the use of such spacecraft propulsion was its effect, 
if any, on Shuttle safety interfaces. This study was instituted to explore 
safety 'iflpli cations for Space Shuttle launched spacecraft using the space 
storable propellant combination of liquid fluorine as oxidizer and hydra- 
zine as fuel (LFg/NgH^). Mission constraints arising from the Space 
Shuttle performance and configuration were reasonably well known but the 
constraints on spacecraft propulsion which result from Shuttle safety con- 
siderations were not. 

The basic objective of the study was to consider ground and flight 
operations and to assess the unique crew and Shuttle hardware safety 


*By JPL and TRW 
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implications which would result from these propellants as compared to the 
earth storable combination nitrogen tetroxi de/monomethyl hydrazine (NgO^/ 
MMH). These implications and corresponding requirements include those 
imposed on the spacecraft, its launch vehicle, ground support equipment 
and on-ground and orbiter flight operations. 


The propellant combination liquid fluorine and neat, unmixed hydra- 
zine (LFg/NgH^) has the advantage that it can draw on a large existing 


technology base from the chemical industry and, in the case of hydrazine, 
considerable flight history from military and NASA flight programs. Sig- 
nificant, perhaps extensive, progress has been made tov/ards developing the 
type of propulsion needed for planetary exploration. Numerous programs 
have been sponsored by NASA involving many aspects of the use of fluorine 
including the self-contained propulsion system demonstration by JPL. The 
Department of Defense has also sponsored extensive research in fluorine 
propulsion. 


As a result of these related efforts in which many millions of 
dollars have been invested, there can be Tittle question that the tech- 
nical feasibility of fluorine propulsion has been demonstrated. However, 
the necessary procedures and techniques to insure safe operations in the 
Space Shuttle launch environment remained to be investigated. 


Previous studies of the feasibility of utilization of space storable 
fluorine oxidizers in relatively small quantities on non- recoverable 
boosters have been favorable while, in the past, consideration of large 
quantities for boost stages has been less favorably received. Technically, 
the pfobl era consists of loadi ng, transporting and carryi ng into space a 
tank containing typically 1000 pounds (450 kilograms) of liquid fluorine, 
which is a toxic hypergolic, cryogenic, potentially corrosive fluid. 


The maximum oxidizer quantity to be considered in this study was 
3000 pounds, a value 1 arger than is required for planetary orbiter missions. 
This quantity is less than had usually been considered in past evaluations 
of the uso of fl uorine Tipper stage pVopulsioh systems^ - 


Two variations of space storable and a typical earth storable pro- 
pulsion system are shown in Figures 1-4 through 1-6. ' 

The propulsion system is for a Mariner class orbiter and represents 
a retro-propulsion system for outer planet orbit insertion. The launch 
vehicle is assumed to be the Space Shuttle as it is configured at the 
initiation of the study. Its upper stage was assumed to be a non- 
recoverable stage which was designated the “IUS/TUG" , meaning some con- 
figuration of an Interim Upper Stage or Space Tug or Shuttle Upper Stage 
(SUS). For purposes of this study it was unnecessary to make distinctions 
between these concepts. 

The study considered within its scope the time frame of launch 
operations from propellant loading at ETR until deployment from the 
Shuttle bay with the IUS/TUG or return to the launch site following abort, 
and then demating from the tug. 

Guidelines for conduct of the study included ground operations fol- 
lowing insofar as possible flow path and timelines of typical Mariner 
spacecraft. Spacecraft flight operations were to be as simple as is 
consistent with meeting an orbital launch window of 30 seconds per revo- 
lution within three orbits following a possible phasing orbit. 

Concern was to be given to promoting efficiency and simplicity of 
ground operations as well as safety of personnel . The guiding criteria 
in assuring ground and flight personnel safety are that the confidence 
shall be equal to or greater than that which exists today for NASA space 
programs. 

1.2 SUBJECTS INVESTIGATED 

The scope of this study included accomplishment of the twelve speci- 
fically identified study tasks and documentation of their results. 

(Section 4 restates the tasks) 
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twelve tasks discussed in Section 4 are: 

Tasks 1 and 2 - Spacecraft Propulsion Launch processing options 
for ground handling. 

Task 3 - LFp temperature control options on the ground and in 
the Shuttle 

Task 4 - Oxidizer leak detection and control 

Task 5 - NgO^ vs LFg propulsion systems comparison 

Task 6 - Oxidizer in-flight dump system, analysis or the possible 
need for 

Task 7 - Fluorine feasibility assessment 
Task 8 - Orbiter cockpit warning displays 
Task 9 - Prelaunch procedures 

Task 10 - Shuttle and spacecrafts hardware impact of fluorine 
propulsion 

Task 11 - Comparison of results with a previous study. 

Task 12 - Flight hazard analysis 


2. SUMMARY 

2.1 OBJECTIVES, APPROACH AND LIMITATIONS 

It was the purpose of this study to compare crew and Shuttle hardware 
safety interfaces which would result from the use of candidate earth stor- 
able and space storable (such as Fg/NgH^) propulsion systems including 
those of the spacecraft, launch vehicle, ground support and on-ground and 
flight operations. 

From a technical standpoint two propellant systems were compared. 

One is the fluorine/hydrazine combination. The other is the well known 
nitrogen tetroxi de/monomethyl -hydrazine combination used on the Shuttle 
Orbit maneuvering system. In either case the oxidizer weight did not 
exceed 3000 pounds.* Both blowdown and externally regulated pressuriza- 
tion systems were considered. 

It was to be assumed that launches will be from KSC using the Space 
Shuttle (STS) as the carrier with its payload a Mariner spacecraft and IUS/ 
TUG.** The NASA designated SUS is assumed to be used to accelerate the 
Mariner spacecraft towards the vicinity of the target planet. 

The overall approach for the study was to accomplish the twelve tasks 
delineated in the Statement of Work in compliance with the stated study 
objectives of: 

• Comparing the safety interfaces between the Shuttle (con- 
sidering both crew and hardware) and the spacecraft propulsion 
system when using LFg as an oxidizer versus NgO^. 

• Identifying any new and/or unique propulsion system requirement 
that would result from the use of liquid fluorine (LF 2 ) as an 
oxidizer in the propulsion system of a planetary spacecraft 
launched from the Space Transportation System (STS). 


*This corresponds to 5000 lbs of total propellant weight which is as much 
as is ever required by a Shuttle launched planetary orbiter. 

**sus ' 


Emphasis was placed on both hazard identification and design solu- 
tions to minimize or eliminate credible hazards.* 

In performing this study, TRW drew on the results of a number of 
previous and concurrent studies that involve the use or F 2 /N 2 H 4 in 
advanced space propulsion systems and other experience in the use of F 2 
as oxidizer at TRW's test facility. Safety aspects of handling liquid 
•fluorine in preflight and flight operations or in a ground-based test 
facility are closely related. Since there is not as yet any experience 
with Space Shuttle launched spacecraft propulsion, it was necessary 
first to identify procedures for earth storable NgO^/MMH propellants. 

After completion of each of the safety tasks considering earth 
storable propellants, the study program tasks were completed for space 
storable propellant to clearly specify how and why the use of the space 
storable propellants might change the safety study results. 

The study utilized system safety engineering methodology to investi- 
gate potential hazards and system design engineering to define how exist- 
ing technology could be used to provide safe operations. 

Due to the value of the Shuttle and its facilities and the manned 
aspects of Shuttle Orbiter operations, which may have their only precedent 
in the Apollo program, significant safety precautions are required. In 
response to this need, compromises of the spacecraft propulsion to achieve 
increased safety have been considered which appear to be acceptable in 
terms of performance and cost. 


*i . e . , one which might reasonably exist or occur. See definition. 
Appendix A, page A-20 


This study was accomplished in two phases. During the first phase 
the twelve tasks of the work statement were addressed. Participation and 
review of this study by NASA Headquarters, JSC, MSFC, KSC and LRC w as 
accomplished by several trips and numerous telephone calls and by mail 
communications. As the program progressed in the second phase the alter- 
native design concepts and trade-offs involved in safe transport of a 
loaded spacecraft in the Space Shuttle emerged. 

Concepts for transport of earth storable NgO^/MMH tended to follow 
the approaches being evolyed for 1) use of earth storable (Transtage or 
Agena derivative) IDS concepts, 2) the OMS kits and 3) hydrazine RCS 
systems on proposed earth orbital spacecraft. Concepts for transport of 
the space storable (cryogenic) l^/NgH^ system evolved from 1) the earth 
storable concepts, 2) previous studies for expendable booster launched, 

LFg based, upper stage propulsion and 3) concepts for cryogenic LOg/LF^ 

IUS or Tug designs.* As the study progressed there was an on-going 
eyolution of the Shuttle payload accommodations, requirements and criteria. 
The IUS and Tug concepts also continued to evolve. The structure of the 
study as it was accomplished can be summarized by nine elements: 

1. Accumulation of design concepts, requirements and criteria. 

2. Establishment of study format based on system safety engineering 
techniques. 

3. Comparison of safety parameters. 

4. Conduct hazard analysis. 

5. Postulate design concepts, processing sequences and procedures 
to eliminate or mitigate hazards. 

6. Evaluate alternate concepts and select most promising. 

7. Document results. 

8. Review with sponsoring agenices. 

9. Refine the results and determine recommended follow-on work. 

The results of this process are summarized in the rest of Section 2. 

*The decision to use solid propellant for the IUS came at the end of the 
study. 
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This study has been limited to some degree by the unavailability of 
detailed information about the Shuttle Orbiter as no description of pro- 
pellant dump accommodations or their design criteria for the Orbiter was 
available. Also, only limited data on the Payload Changeout Facility was 
available. 
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2«i_ SAFETY PARAMETER COMPARISON OF LF 2 VS N 2 0 4 

2.2.1 Comparison of Safety aspects between propellants involves a 
number of considerations related to physical and chemical properties of 
the propellants and physiological effects on humans. Some of these 
aspects are compared in Table 2-1 . 


Table 2-1. 

COMPARISON OF SAFETY ASPECTS 



ASPECT 

»2°4 

LF 2 

1. 

STATE OF LIQUID AT USE 

•v 50 PSIG EARTH STORABLE 

0 PSIG GRYOGENIC 

2. 

EMERGENCY EXPOSURE LIMIT, 
PPM 

30 (10 MIN. N0 2 ) 

15 (10 MIN.) 

3. 

OSHA LIMIT, PPM** 

(5,0 N0 2 )* 

0.1 (QUESTIONABLE) 

4. 

THRESHOLD LIMIT VALUE*** 

(5.0 N0 2 )* 

1.0 (REVISED FROM 0.1) 

5. 

BREATHING 

INDIVIDUAL WILL DAMAGE 
HIMSELF UNKNOWINGLY 

WILL NOT BREATHE OVER 
25 PPM (5 MIN. EEL) 

6. 

OLFACTORY DETECTION 

NOT UNTIL EEL 

IMMEDIATE AT TLV 

7. 

PHYSIOLOGICAL EFFECTS 
AT SELF-DETECTION 

DELAYED PULMONARY EDEMA 

MINOR OR NONE 

8. 

TOXICITY OF REACTION 
PRODUCTS 

BETTER: NO g , NO, N 2 , Hgt) 

WORSE THAN FOR H^S HF 

9. 

VULNERABILITY IN USE 

UNINSULATED 

INSULATED 

10. 

FIRE CONTROL 

DIFFICULT 

DIFFICULT 

11. 

EXPLOSION 

0.05 TNT/LB 

-v 0.02 TNT/LB ROM 

12. 

SPILL DISPERSAL 

WORSE 

BETTER 


* n 2 o 4 dissociates to nq 2 IN THE atmosphere 

** 8 HCUR WORK DAY 

*** REFERENCE 1 - THRESHOLD LIMIT VALUE FOR REPEATED 8 HOUR WORK DAY 
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A major difference in the two oxidizers is that fluorine is only 
liquid at cryogenic temperatures. This requires that cooling must be 
supplied, such as by liquid nitrogen, except for relatively brief periods 
determined by the thickness and efficiency of the tank insulation. 

Both propellants are toxic, but can be detected by smell. Detection 
of NgO^ occurs only at a much higher concentration, however, and a person 
can fail to detect harmful concentrations. Work area concentrations 
allowed by law under the Occupational Safety and Health Act* are much lower 
for fluorine than for NgO^. 

Toxicity of fluorine on the applicable basis of ten minute Emergency 
Exposure Limits, EEL, is 15 ppm versus 30** for NgO^ a ratio of 2:1. 
Inhalation by personnel of a much higher concentration of fluorine than 
the EEL is considered impossible because its stifling effect is so severe 
that choking and asphyxia would result if relief or escape were delayed. 

At comparably toxic levels with NgO^ a person is less aware of the danger 
‘ . and may collapse the next day from a delayed pulmonary edema. 

Linder conditions of reaction of the oxidizers with other materials, 
such as fuels or water, NgO^ decomposes to form the less toxic substances 
NOg and NO. It reacts with water to form nitric acid and with carbon to 
form carbon dioxide or carbon monoxide. Fluorine reacts with water to 
form the somewhat less toxic HF and with carbon to form inert CF^. 

Reaction with carbon (charcoal) can be used to dispose of LFg. 

In case of a fluorine spill , ambient heat can turn the liquid to 
vapor in a matter of one to ten minutes. For a spill of NgO^ a somewhat 
longer release time would be involved although NgO^ boils at a relatively 
low 21 °C (70° F) ; . The dispersal . of spilled LFg is considered to be. some-, 
what better because of the lower molecular weight of fluorine as compared 
to NgO^, NOg and HN0 3 and because reaction with atmospheric moisture 

*Safety and Health Standards Section 1900-1000 Subpart' Z, Table 2-1 as of 
May 1975. Occupational Safety and Health Administration. 

K'-LL y - • - **Parts per million 


■ tends to produce heat in the cloud which encourages vertical dispersion. 

Spilt tests with LF 2 were conducted at AFRPL in quantities of approxi- 
mately 1000 lbs. Data from these tests can be used as a rough guide in 
formulating distances for personnel concentrations during propellant 
flowing and handling in this application. 

Both propellants are hypergolic with amine (hydrazine based) fuels. 
Fluorine, however, is also hypergolic with many other fuels, and even 
reacts vigorously with water producing hydrofluoric acid, oxygen, and 
steam. Fire control is thus difficult, as it is with other strong 
oxidizers. 

Explosive hazard estimation involves certain assumptions and depends 
on the fuel available, but because of the somewhat greater reactivity of 
fluorine, its explosive potential is considered less than NgQ^ because it 
is more difficult to achieve a concentrated mixture of reactants. 

( } 2,2 Results 

In the rest of this section, the overall results of this study are 
summarized by main topics of interest including: 

- Effect of fluorine as compared to NgO^ on KS£> operations 

. Effect of fluorine as compared to RgO^ on ETR operations 

- Effect of fluorine as compared to NgO^ on Shuttle Post Launch 

operations 

- Effect of fluorine as compared to NgO* on the Shuttle Orbiter and 
the Shuttle Upper Stage 

Effect of fluorine as compared to NgO^ on Spacecraft Propulsion 
System Design 

- spacecraft Propulsion System design recommendations 

: in Sections 3 and 4 of this report, the technical background for 

the use of fluorine and the detailed exposition of the original. twelve 
tasks of the study are described. The appendices include important data 
as to the JpL design concept, glossary of terms and launch site and 
I. . flight /hazard "analyses.. ; --l-: VI .l:'"".';'": y :: V; v V'. ; V.' V' V ; V^ : V ; v l,-V 



2.2.2 Effect of Fluorine as Compared to Nr .0^ on KSC Operations 

2.2. 2.1 Spacecraft Processing Options 

Many processing options were considered to determine how the empty 
spacecraft propulsion system should be loaded with oxidizer and how the 
installation into the Space Shuttle should be accomplished. 

The two loading alternatives considered were: 

1. Loading of the spacecraft tanks remotely from the pad. 

2. Loading of the spacecraft tanks at the pad. 

Remote loading was clearly indicated. 

The other main consideration was whether the spacecraft should be 
installed into the Shuttle Orbiter in the normal payload processing loca- 
tion at the Orbiter Processing Facility, or via the Payload Changeout 
Room at the pad. 

Other variations of integration sequence with the I US or Space Tug 
were also considered. As for comparisons between the two oxidizers, there 
is no basic difference in the recommended processing sequences for LFr, 
and N o 0^ except as noted later. 

The recommended sequence was based on the following criteria: 

1. For safety of KSC personnel and the Shuttle, spacecraft propel- 
lant should be loaded remotely from the pad. 

2. Mating of the spacecraft with the IUS/Tug should be done either 
in the Shuttle Orbiter Bay or in the Payload Changeout Room to 
avoid transporting spacecraft propellant through the QPF and VAB. 

3. In order to yeri fy form, fit, and function of the interfaces 
between the Spacecraft and the IUS/Tug and the Spacecraft and 
the Orbiter, a preliminary "dry” mating may be required with the 
IUS/Tug and Shuttle or Shuttle simulators. This would be done 
early in the schedule of prelaunch operations. 

4. The resulting steps are shown in Figure 2-1. 


SELECTED PROCESSING SEQUENCES 


ro 

i 

to 





LAUNCH 
OPTION 4 


PCF 


PCF 


ORBITER 


* A SPARE PROPULSION SYSTEM MAY BE INCLUDED 
** LF 2 REQUIRES LN 2 COOLING IN ALL SUBSEQUENT STEPS UP TO LAUNCH 


Figure 2-1 


.. -- -- — — 





The only difference between sequences recommended for LFg and that for 

is that liquid fluorine requires cooling from the time of propellant 
loading until launch. 

In this sequence, the spacecraft is received at the launch site and 
checked out to verify that no damage occurred in transportation. Next 
it is dry* mated with the IUS or Tug in a location such as the Spacecraft 
Assembly and Encapsulation Facility to verify compatibility of form, fit 
and function of the mechanical and electrical interfaces. Verification 
of compatibility with the Shuttle by means of a Shuttle Simulator is also 
anticipated. These checks would minimize the chance of a loaded spacecraft 
meeting the I US/ Tug or Shuttle for the first time at the pad in an incom- 
patible condition which could impact the prelaunch schedule and hence 
threaten a slip in the launch-readiness date. 

Next the spacecraft propulsion is isolated and taken to a remotely 
located Oxidizer Dedicated Facility, for example ESA-60 suitably modified. 

(;) Propellant loading always, of course, takes place with minimum personnel 

exposure. 

m ' 

After an appropriate stabilization period it is recommended that the 
loaded propulsion be taken to a "propulsion garage." The propulsion 
garage is a remotely located building of simple construction which is 
suitable for storage of the propulsion system. The propulsion system is 
monitored for leakage or other changes of status. 

As the launch readiness date approaches, the loaded propulsion system 
and spacecraft are integrated and transported to the Payload Changeout 
Facility. Depending on the design of the spacecraft and lUS/Tug, inte- 

grati on of the spacecraft and IUS or Tug occurs either inside the Shuttle 

Cargo Bay or in the Payload Changeout Room, (option 3 or option 4). 

*i .e. empty of propellants / 
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2. 2. 2. 2 Spacecraft Timeline For Pre-launch Operations 

Spacecraft time Vines for LF^ and N 2 0 4 are virtually identical except 
for a few hours required to disconnect and reconnect N 2 cooling lines when 
the propulsion system is moved after loading. A period of thirty days in 
the loaded condition is considered appropriate to gain assurance that the 
tank is sound. 

2. 2. 2. 3 Shuttle Timeline for Pre-launch Operations 

Shuttle timelines for LF 2 and are expected to be the same except 
for an additional period for LF 2 spacecraft not exceeding three hours. 

This time period is considered necessary to 1) clear the pad for arrival 
of the loaded spacecraft (one hour), 2) clear the pad for reconnection of 
LN 2 coolant at the Payload Changeout Room (one hour), and 3) clear the 
pad for reconnection of the LN 2 coolant after installation in the Orbiter 
(one hour). All of the effects of propellant safety considerations includ- 
ing pad clearance times total a maximum of six hours for N 2 0^ and nine 
hours for LF 2 as shown in Figure 2-2. 


0UR1NG 

TRANSPORT 


1 HR TO 
CONNECT LN 2 


1 HR TO 
CONNECT LN 2 


Figure 2-2. Launch Pad Operations 
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2. 2. 2. 4 Effects of Fluorine as Compared to on KSC Facilities - 
Payload Changeout Facility 

Effects of fluorine as compared to NgO^ in the design of and acti- 
vities in the Payload Changeout Facility are similar to those at the 
spacecraft propellant loading site (ESA). The key items are: 

1. Automatic fluorine-specific yapor detection equipment is recommended. 

2. Some additional care in evacuating and minimizing personnel during 
arrival of the fluorine system and its installation into the Payload 
Changeout Room, (e.g. personnel may be evacuated prior to arrival of 
the spacecraft). This is due to the somewhat greater toxicity of Fg. 

3. A time allowance for connection of LNg cooling to the system after 
installation in the Payload Changeout Room. 

4. Availability of cryogenic LFg dewar tank or truck for propellant 
drain in case of inability to either continue pre-launch operations 
in accordance with the timeline or "back-out" the propulsion system, 
whether it is in the PCR or Qrbiter Bay. 

A leak or spill of fluorine or NgO^ at the Payload Changeout Facility 
would be of much greater consequence than a like incident at the ESA-60 
because it would involve more expensive facilities and equipment and 
could impact the Shuttle timeline. In order to minimize this possibility 
for either type of oxidizer, the following recommendations are made; 

1. Propellant loading to be done remotely. 

2. The pad area to be evacuated except for essential personnel during 
movement of propellant. 

3. A continuous monitoring of safety status to be implemented prior to 
propulsion arrival if not previously instituted. This includes 
propellant tank temperature, pressure and vapor detection in the PCF. 

4. Procedures to be established and practiced to cope with emergencies. 

5. Fire control equipment to be available and under control of a well 
, trai ned person. 


2.2.3 Effect of Fluorine as Compared to on ETR Facilities 

2. 2. 3.1 Spacecraft Explosive Safe Facility 

ESA-60 has been successfuly used for loading of Mariner spacecraft 
with NgO^/MM'H and could presumably be modified to accommodate fluorine. 

A modified ESA-60 or other oxidizer facility designed to handle fluorine 
on an intermittent basis will require, as does the NgO^ facility, a 
reactivation prior to and deactivation after each launch. All lines and 
yalves and any tanks should preferably be maintained in a purged, dry and 
inert condition to prevent possible corrosion by fluorine in combination 
With moisture. 

For use with LF2, the following capabilities would be needed for a 
modified ESA-60 or other site: 

1. Remotely operated fluorine transfer lines for transfer from trailer 
truck to spacecraft propellant tanks 

2. LN 2 cooling equipment and LN 2 dewar 

3. Reactors for disposal of fluorine purged from the propellant loading 
lines 

4. A reactor capable of disposal of one full load of propellant in an 
appropriate time interval 

5. Propellant vapor detection equipment for personnel protection 

6. Propellant drainage channels in the floor of the building to a treat 
ment sump for fluorine disposal 

7. Isolation and compartmentation of the fluorine lines to minimize 
damage in event of a failure 

8. Fire control equipment including tanks for providing water spray or 
. other appropriate fluid 

9. Television coverage in color of the loading area with display in the 
remote control center (color to aid in discernment of the nature of 
the vapors) 


10. A "propulsion garage" remote from other buildings for storage of the 
propulsion system (to attain personnel safety and protect facilities 
from corrosion or other damage) 

11. Perimeter control of the site during operations to limit access of 
personnel to the loading site 

12. Recognition of meterologi cal conditions in establishing safe loading 
periods (which typically occur daily) 

2.2.4 Effect of Fluorine as Compared to Nn O ^ on Shuttle Post Launch 
Operations 

2. 2.4.1 Nominal Case 

The only effect on the Shuttle of fluorine as compared to Ng °4 after 
a normal mission may be the requirement for purging and sealing of fluorine 
dump lines in the event dumping of spacecraft propellant would be required. 

2. 2. 4. 2 Shuttle Abort Cases 

After a Shuttle abort, the effects will depend on the type of abort and 
the condition or state of the spacecraft propellant tank and fluorine dump 
line (if used). Each abort case is summarized below: 

1. Normal complete dump to vacuum (as in abort from orbit) - no effects. 

2. Dump valve malfunction resulting in a landing while still loaded. This 
requires connection of a disposal system to the LFg and drainage of the 
propulsion system before further Shuttle processing. 

3. RTLS abort in atmosphere with suspected fluorine residue either liquid, 
solid or gaseous. 

This requires connection of LNg cooling or disposal from the end of the 

dump line. 

4. Return of the Shuttle to an unexpected landing site of opportunity would 

. req ut re . some means for cooling the f 1 uori ne or di s posing of it in a safe- 
.. manner. 


2.2,5 Effect of Fluorine as Compared to N oO y| on the Shuttle Orbi ter 
and the Shuttle Upper Stage 

2. 2. 5.1 Flight Operations and Modes 

In normal flight operations, the LFg/NgH^ propulsion system will be 
disconnected from ground cooling at T-0. It will have on-board cooling 

for 24-36 hours provided by LN 2 Dewars. The tanks will be unpressurized 
(1 bar, or 0 psig) from liftoff to deployment of the spacecraft from the 
Shuttle Orbi ter. Prior to use of the spacecraft a back-off maneuver of 
approximately one mile separation between the Shuttle and spacecraft/SUS 
will be accomplished. Only after the back-off maneuver wi 1 1 the space- 
craft be pressurized. No operation of the spacecraft propulsion will 
occur until 7-21 days after departure of the spacecraft from earth orbit. 

Abort modes considered include: 

o Return to launch site 
o Abort to orbit 
o Abort once around 
o Abort from orbit 

o Landings at landing sites of opportunity 

Flight hazards from oxiuizers, either N 2 0^ or LFg would result from: 

o Tank leakage 
o Tank overpressurization 
o Tank damage 

o Dump system contamination 
o Residual propellants and yapors after flight 

In the RTLS , abort hazards could result from either Shuttle caused or 
payload caused r alts. In order to reduce hazards, secondary leakage 
containment and dump lines were considered. Abort to orbit and abort once 
around were found to be similar and easier to accommodate as dumping into 
Vacuum could be accomplished and at a more leisurely pace than during RTLS. 


AFO could involve a logger time for cryogenic propellant to heat up, 
however, there is also a longer time to perform propellant dump or payload 
jettison procedures. 

Landings at sites of opportunity could involve additional risks if 
equipment to handle residual F 2 is not available, however this is a secon- 
dary hazard since all oxidizer is assumed normally dumped. There is need 
for an additional study of this landing mode. 

In order to accommodate the spacecraft propulsion, a number of 
effects on the Shuttle Orbiter will be incurred. Most of these are 
needed for both and LFg except for the LN 2 coolant supply. 

Affected systems in the Shuttle bay are: 

1. Common requirements for and LF 2 : 

- Dump line (LF 2 requires an F 2 passivated line) 

~ Spacecraft relief valve effluent line 

- Exclusion of combustibles to the extent possible 

2. Specific LF 2 requirement: 

- LN 2 coolant supply 

For liquid fluorine a special fluorine dump line may be required, 
and fluorine oxidizer tank relief lines will be required. A dump line 
for the fluorine tank will have to be passivated. It is suggested that 
during flight, helium pressure be maintained in the line to insure its 
cleanliness. 

The effects of possible leakage on the Shuttle Orbiter, if not 
sufficiently well inhibited by double wall tanks or by vapor tight shroud 
techniques, would be a need to eliminate all materials from the cargo bay 
susceptible to ignition by fluorine. This does not appear, however, to 
be a practical measure. If the fluorine tank is provided with a double 
wall, the possibility of fluorine vapors in the Shuttle bay may be con- 
sidered to be reduced to such a low value that vapor containment by the 
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spacecraft shroud is not necessary. For the as the oxidizer, a 
vapor tight shroud should be considered. It was beyond the scope of 
this study to make final recommendations as to leakage containment 
techniques. SUS (IUS or Tug) interfaces are probably the same as the 
Shuttle bay interfaces as these functions will probably be routed 
through the SUS. 

The Shuttle Upper Stage (SUS for this study was designated lUS/Tug) 
meaning the Interim Upper Stage or Space Tug, and covers both desig- 
nations as appropriate. 

Effects on the SUS or IUS/Tug may include: 

1. A dump line and disconnect between the spacecraft and the SUS, 
and an umbilical fitting at a SUS to Orbiter interface together 
with an overboard dump line would be necessary if a spacecraft 
dump requirement is imposed. 

2. An oxidizer tank relief line appears to be required. It would 
be routed from the spacecraft through the SUS and Orbiter inter- 
faces as described in (1) above. Figure 2-3 illustrates this 
routing. 


DUMP LINE CONCEPT 
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Dumping always occurs at less than 0.1 psi {.007 bar) and can be 
into the wake of the Orbiter and it is expected that oxidizers will 
either be quickly diluted by the low pressure atmosphere, or will 
expand to very low pressures if at orbital altitudes. The Shuttle 
vents will be closed at this time but are expected to leak. For this 
reason, some very low vap'T pressure of oxidizer could theoretically 
recirculate into the cargo bay. Although further analysis is suggested 
it appears highly unlikely that a significant concentration of fluorine 
could enter the cargo bay via such recirculation. 

Cockpit functions will include for either oxidizer tank, status 
monitors for; 

- tank pressure 

tank temperature (for LFg) 

- vapor detection 

Modifications needed on the exterior of the Shuttle will include dump 
ports for the liquids if dump is required and (vapor) relief ports. 

2.2.6 Effects of Fluorine as Compared to N qO^ on Spacecraft Propulsion 
System Design 

2. 2. 6,1 Spacecraft Propulsion Requirements and Technical Base 

Substitution of higher energy LFg/NgH^ for the N^/MMH propellants 
used in Mariner class spacecraft primarily introduces the considerations 
related to a cryogenic propellant. 

The Shuttle considerations are primarily those of transportation, 
since the Shuttle is used to transport this propulsion system in an 
i*iert state. 

The spacecraft propulsion system has; 

- No operation in the Shuttle 

- No operation near the Shuttle 

Only after deployment and after SUS operation does this system per- 
form trajectory corrections and orbit insertions. These events do not 
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begin until 7 to 21 days after departure from earth orbit. Thus, no 
pressurization of the spacecraft propellant tanks is needed until it 
is far from the Shuttle. 

Parameters of a typical payload propulsion system are as shown in 
Table 2-2. 


PAYLOAD PROPULSION SYSTEM CHARACTERISTICS 

lf 2 /n 2 h 4 



PROPELLANT WEIGHT, KG/LB 
OXIDIZER 
FUEL 


454/1000 TYPICAL 
318/700 TYPICAL 


ENGINE THRUST, NEWTONS/LBF 2670/600 

CHAMBER PRESSURE, N/CM 2 //PSIA 69/100 

TANK PRESSURE, N/CM 2 //PSIA 

OPERATING 241/350 

IN SHUTTLE BAY 10/14.7 



The system resulting from the study is illu. rated schematically in 
Figure 2-4. It is a four-tank blowdown system featuring propellant 
isolation. Figure 2-5 illustrates connections. 
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Table 2-3. 

Mariner and LF 2 Fluorine in Hardware Assumptions of the Hazard Analyses 


• 

STUDY BASfUHt 
Siurmx LAUNCH CtitlF I GlfRAT 10H 

SIIUTUC PREFERRED 
{ MODIFIED) SYSTEM 

ITEM 

»2°4 

lf 2 

np>A 

LFj 

Oxidizer Tank 

0 6A14V Titanium 
o 100 psl typical 
o Can take vacuum 
o designed far leak 
before burst ( 

o Can take vacuum 
o OAL-flV 

o Thoroughly cleaned 
and passivated 
o Unsigned for leak 
before burst 

u Same as baseline 

o Same 

o Double wall desirable 

Detectors {press* 
temp* vapor) 

o Temperature and 
pressure 

o Cockpit and ground 
analog alam 

o Temperature and 
pressure trans- 
ducer, alarm and 
rtadout 

o Vapor detector 
(digital typo) 
o Mi, detectors in 
cargo bay. 

o Cockpit and ground, 
analog and alarm 

o Same as baseline 
o Vapor detector in 
shroud desirable 

o Same as for the 
baseline dr.-sign 
u Also detectors required 
in the cargo bay. (If 
ever 1VA, e.g», 
emergency) 

Pimip/Yent system 

d Dump capability pro- 
vided through the 
the IUS/TUG umi. 
via kit* Processed 
through oribter 
dump piping 

0 SanV! as NjjOj$ 
(assumed for 
emphasis} 

o Can use other 
hypergol dump 

o Make durp sys compatible 
with LFg 

Vent or pressure 
relief system 

o Gas pressure relief 
system provided- 
burst disk and Iso- 
lation valve in 
scries with burst 
disk. One for each 
tank 

o No vont system 

o Same as baseline 

o Specially designed vent 
system for venting over- 
board when shuttle bay 
doers are Dpnrt only. 
Contains double rt Jundant 
burst disk, nozzle, valve 
piping eLc. 

o Passivation and cleanness 
req. 

Sbrpud 

o Partial shroud 
(protect 
electron^) 

! 

o Partial shroud 
(purlect 

electronics) 
o Hot designed tu 
resist l-i corrosion 

o Full leak tight 
shroud, vented to 
space 

O Full stirojris. The shroud 
should bo designed tc be 
as resistant against Lf 2 
corrosion as possible and 
vent ?2 vapor overboard. 

The shroud slid 11 be designed 
to prevent leaking of F;> vapor 
outside the shruud 

Pressure Supply 
(blow-dawn is 
pressure regu- 
lated) 

o Separate pressure 
supply 

o Regulated system 
used 

o Pressurized during 
launch 

o Separate pressure 
supply 

o Regulated or 

equivalent pressure 
sy slept required 
o Not pressurized 
during launch 

o Same as baseline 

o Regulated ur equivalent pres-. 

sure system provided 
o Same as baseline 

Insulation 

o Hot insulated 

o Insulated 

o Hot Insulated 

o Insulated, same as for baseline 
sys 

Stresses 
(vertical 
horizontal ) 

o Designed for axial 
and horizontal 
stresses 
o Designed for 
tank to stay in 
place during crash 
landing 

o Same as for W 9 0./ 
Shuttle £ q 

o Same as baseline 

o Same as for H-jD^/Shuttle baseline 
except that tfic liquid in the 
container Should he contained 
safely in a crash landing 

Oxidizer tank 
shell (contains 
leaking vapors or 
liquids) 

o ifo shell 

o Leak shell provided 

o No shell (may use 
shroud) 

o Leak shell provided 

Off-load 

capability 

o Provided for 
before launch 

0 Provided LF^ com- 
patible dump hefore 
launch only 

0 Hypprgolic Oxidizer 
dump system 
o Fmergcncy deploy- 
ment 

o Off-load capability possible 
via the veo!-sys and the LF£ 
compatible dtfcip system 

Catch pan 
syslpji 

o Ho eaten pan 
system 

o Shell only and.no 
catch pan 

□ Dike system 
desirable If not 
under pressure 

o Catch pan and shell 
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New propulsion technology available for fluorine propulsion includes 
compatibility testing, electron beam welding, fracture mechanics tech- 
niques, the AFRPL developed bobbin seal , and a better understanding of 
compatibility and passivation. 

Materials selections will be based on experience being acquired at 
JPL and in the industry on fluorine rocket and corollary high energy com- 
bustion devices. JPL has successfully demonstrated a complete self- 
contained (but not flight weight) Fg/NgH^ propulsion system. 

2. 2. 6. 2 Hazard Analysis 

A hazard analysis was conducted, ar.d the results derived from it are 
largely reflected in the propulsion system design recommendations, dis- 
cussed later. The details of the hazard analysis are included in the 
basic document, but the assumptions upon which the analysis was based is 
presented in Table 2-3 on the last half of the page. The changes in 
these assumptions, as a result of the hazard analysis, are shown on the 
right half of the Table. 

2. 2. 6. 3 Spacecraft Propulsion System Design Recommendations 

The primary effects of fluorine on spacecraft propulsion system 
design are to require tank insulation, ground cooling and relief line 
provisions, and fluorine compatible materials. Propulsion system design 
criteria Which may be considered as recommended criteria for fluorine 
and good practice for NgO^ include: 

1. System design should preclude significant pressure in the tankage 
during transportation from the loading site to the pad and during 
transportation in the Shuttle. The fluorine tank should be pres- 
surized only after the SUS is deployed from the Shuttle Orbiter. 

2. Fluorine (and probably NgO^) should be isolated in its tank by 
closed isolation valve mounted as close to the tank as practical. 
This state would be maintained until after Tug deployment from the 
Shuttle Orbiter. 


2-23 


3. Plumbing systems upstream and downstream from the isolation valves 
to the next valve should be passivated to provide a fail-safe re- 
dundant propellant containment. 

4. Double wall tankage should be considered for LFg. 

5. All associated equipment and procedures of the LFg system should 
be fail -fail -safe, or at least fail-safe. 

6. Fail-safe operations are needed during propellant loading. 

7. A leakage detector sensor is desirable between the walls if a double 
wall tank is used. 

8. Caution and warning instrumentation should be proyided and monitored 
during propellant loading, storage, transport to the pad, instal- 
lation in the orbiter, in flight and during SUS deployment in orbit. 
Temperature, pressure and leakage information is required. Pressure 
transducers should have double redundant propellant containment. 

9. In the spacecraft both types of oxidizer tanks would be relatively 

well protected from inadvertent mechanical damage. The LFg tank 
would have external insulation to the extent of approximately two 
to three inches of closed cell PBI foam. In addition, the LF 2 tank 
could incorporate a double wall. tanks would be coyered with 

multi-layer insulation. 

IQ. Command signals to the spacecraft propulsion should be inhibited 
until the deployment in orbit away from the Shuttle. 

11. It is desirable to have a vapor tight shroud (shroud concepts are 
shown i;n Figure 2-6. 

12. It is desirable for cargo bay components to be metal , dense ceramics, 
and fully fluorinated elastomers. 

13. Crew air Intake (if any) should be effectively separated from propel- 
lant vent ports. 

14. Combustible vapors and projectiles from other systems in cargo bay 
should be prevented. 
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FROM JPL STUDY 


Figure 2-6. 



Figure 2-4 showed schematically a system which incorporates the 
desired features including propellant isolation. Figure 2-5 illustrated 
features of the double wall tank concept that could be used consistent 
with this system schematic. 

2.3 CONCLUSIONS AND RECOMMENDATIONS . 

2.3.1 Conclusions 

As a result of this study, a number of conclusions can be drawn 
about design criteria and requirements, and ground and flight procedures 
necessary to maximize the chance of safe and successful transport of a 
spacecraft fluorine propulsion system in the Space Shuttle. These con- 
clusions sre: 

• The chance of an incident {hazard) occurring is reduced by isolat- 
ing the LFg in the tank and not allowing any fluorine in valves or 
piping during handling of the loaded system on the ground or during 
the Shuttle phase of the flight. 

• Current techniques for handling fluorine in commercial applications 
and at rocket test sites appear applicable, with refinements, to 
loading fluorine in payloads for Shuttle. 

• Propellant should be loaded into the spacecraft at a remote location. 
The propulsion system should be monitored and allowed to stabilize 
prior to transporting and installing the spacecraft into the Shuttle. 

• Use of an oxidizer dump system for LF 2 during flight appears tech- 
nically feasible, but the entire dump question requires further 
investigation. 

• Ri.sk to personnel is best reduced by excluding people from proximity 
to toxic materials during the processing, and by providing effective 
protective clothing and by instituting careful "back-out" procedures. 

• In order to achieve the required level of safety with fluorine some 
additional Shuttle pre-launch operations time, in the order of a few 
hours, may be needed. 
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m The safety effort required to control hazards to protect equipment, 
facilities and personnel is significant and may be justifiably 
higher than for previous, unmanned spacecraft. It is expected, 
however, that safety related costs will be a fraction of propulsion 
costs. 

• The safety program for fluorine should be started and implemented 
during the hardware development phase, should be oriented towards 
specific goals and should incorporate the System Safety Engineering 
approach throughout the program. 

• A safety assurance function in cooperation with the quality control 
function must be provided to assure that all safety requirements 
are met when the payload is installed into the Orbiter. 

d The effects of residual hazards during flight in the Space Shuttle 
Orbiter Cargo bay from properly isolated propellants in a propulsion 
system which has been loaded and stored prior to transportation on 
the Shuttle appear low and the number of residual hazards appear few 
provided that hazards to the propulsion system from other systems 
are minimized. 

• Transportation of the system should be in the unpressurized (or 
nearly unpressurized) state to minimize the effects of any leaks 
(ICC regulations limit transportation on highways to 300 psi). 

• The concept of a "propulsion garage" at the launch complex for safe 
storage of the loaded propulsion system during the verification 
period after loading and prior to launch is suggested. 

• The use of double (redundant) wall' pressure vessels for oxidizer 
containment is suggested 

• Propellant vapor detection in the void between shells is suggested. 

• Use of inert gas in fluorine dump lines to protect the passivation 
and to provide verification of dump line integrity (if dump pro- 
visions are required) is suggested. 
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2.3.2 Recommendations 


Additional system safety engineering and propulsion system design 

engineering efforts are recommended as indicated below. Close coordination 

with the Shuttle Orbiter and Tug designers will be required as it was 

during the execution of this study. 

1. A more complete definition of the implications of and need for a 

propellant dump system for fluorine considering the actual technology 
available for such a system and more complete definition of the 
impacts to the Shuttle Orbiter design. This should include a) dump 
yalye and line design, b) reliability considerations and c) a safety 
comparison Cdump versus no dump). 

2= Propellant tank design and demonstration activity to demonstrate the 
feasibility of flightweight, long term fluorine containment in a 
redundant wall tank. 

3. Advanced development of long-life, leak-tight propellant isolation 
valves in the 1 to 2 inch line size which will allow propellant to 
be dumped within the allowable time constraint (if dump is required), 

4. Continued definition of the propulsion system, including the shroud 

and line routings especially for the coolant (and dump lines, if required) 

5. Technology work on the propulsion system which will allow fully realistic 
design layouts to be made. 

6. Advanced development of LF 2 and vapor detection equipment. 

7. A study of the requirements for equipment to accomplish safe landings 
and aborts to landing sites of opportunity. 
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3, BACKGROUND TECHNICAL CONSIDERATIONS RELATED 
TO THE USE OF FLUORINE 

3.1 INTRODUCTION 

While fluorinated oxidizers are among the most vigorous of oxidizing 
substances, experience in the handling of large quantities of these fluids 
has shown that with suitable designs and attention to detail, reliable 
and safe utilization of these oxidizers is being obtained on a day-to-day 
basis. As an example, liquid fluorine transportation in 5000 lb capacity 
truck trailers is carried out with a high level of safety and reliability. 

The utilization of the fluorinated oxidizers will require some 
changes to be made in procedures for the development of propulsion system 
stages from the initial design through the post-launch operations. One 
of the purposes of this study has been to examine where specific changes 
are required and how these compare to standard procedures developed for 
currently used liquid propellant propulsion systems. In accomplishing 
this study, the technology base developed for fluorine handling related to 
rocket engine testing, and other fluorine combustion devices. In the sec- 
tions that follow the various aspects of work that has been accomplished 
and how it may apply to the subject study will be discussed. Although pro- 
pulsion system design and development are not the main subject of the 
work accomplished, designs and development of the system will be affected 
by launch safety considerations. Some of these elements and the methods 
of approach to finding solutions are discussed briefly below. 

3.2 SAFETY ASPECTS, CHARACTERISTICS AND ENVIRONMENT 

In its use, the spacecraft propulsion system will be surrounded by 
propulsion systems having similar characteristics. The OMS and OMSKITS 
will use N2O4/MMH propulsion, and eventually the TUG may use two cryogenic 
propellants, liquid oxygen and liquid hydrogen. 

Both fluorine and nitrogen tetroxide are vigorous oxidizers which 
are toxic and potentially corrosive (in the presence of water). Safety 
aspects are similar for the two, however they differ in degree and in 
addition, LF 2 is a cryogenic liquid with a normal boiling point of -I88°C 
(-307°F) . The safety aspects were summarized in Section 2.2.1. 


Fluorine is readily detectable by its pungent odor at very low 
concentrations. The threshold of detection by odor is generally accepted 
to be 0.3 ppm and may be as low as 0.1 ppm. The Emergency Exposure Limit 
for exposure to concentrations of 30 ppm is 15 to 10 minutes (Reference 1). 
Since small leaks can be detected by odor well before lethal limits are 
attained, personnel can usually be evacuated from the area before oxidity 
becomes a problem. It should also be noted that, in general, the toxic 
effects are not residual or cumulative as with some chemical compounds. 

Additional safety precautions and monitors are needed to monitor leak- 
age, as substantial fluorine leaks coming into contact with fuels can 
cause ignition which can propagate even into metallic materials. 

A study was made of the design of the spacecraft assembly bay and 
Shuttle cargo bay to determine the best means of dealing with leakage of 
LF 2 from the propellant supply system. Such leakage will probably occur 
upstream of the main propellant shutoff valves. Unless the leakage results 
from failure of the tank wall it will most probably occur in that part of 
the feed system upstream of the main propellant valve which contains the 
greatest number of components. This is usually the section containing the 
pressurization and vent valve assemblies, and for that reason a tank inlet 
isolation valve is suggested. 

The tradeoff must be made between a system designed for maximum relia- 
bility and minimum leakage and the desirability of being able to remove 
and replace a leaky component. The use of an all welded system for maximum 
reliability and minimum possibility of leakage, will require offloading of 
the fluorine, purging of the system, possible disassembly of portions of 
the spacecraft and cutting out and rewelding of the faulty component. 

This penalty which has to be paid for maximum reliability systems must be 
weighed against the higher risk of leakage when flanged or threaded com- 
ponents are utilized which could permit replacement of the component in 
situ. It is our judgement that an all-welded system, or one with a mini- 
mum number of bobbin seal joints is appropriate. 

To provide a drain capability the system must be designed with a 
means for accomodating the connection of a drain line and pressurization 
line. Both of these are penetrations of the basic feed line system and 
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are themselves subject to leakage and hence reduce reliability. Transfer 
of the propellant will most probably be made in the liquid form. 

3.3 DESIGN 

Differences between the designs for current liquid bipropellant 

•k 

rocket propulsion systems and those using cryogenic fluorine or fluorine 
compounds will be the materials selections to assure compatibility with 
fluorine, provision for passivation of components exposed to fluorine, 
and the methods of construction selected for the fluorine system to 
insure maximum safety and reliability. Some have stated that there are 
no great differences in the requirements for system cleanliness, or other 
aspects of quality assurance, between current storable liquid propulsion 
systems and those using fluorine compounds. The present specifications 
which are imposed on spacecraft propulsion systems in order to insure 
maximum reliability are in general, sufficiently stringent for both sys- 
tems. This should be qualified to state that using present knowledge, 
procedures for cleanliness and passivation can be developed which are 
generally similar to those for currently used propellants. The passivation 
layer rcsquires protection from mechanical damage which might remove it. 

The most notable tradeoff which might be made in comparing the 
designs for the two systems is in the methods which are used in joining 
the feed system subassemblies and components. The greatest number of 
problems which occur with fluorine systems are usually associated with 
joints in lines and fittings, or between lines and components. It has 
been found that the most reliable means of joining the fluorine flow 
system components is to arc-weld all joints in an inert atmosphere in such 
a manner as to present a smooth interior, free of crevices, bubbles or 
slag inclusions. Good practice calls for x-ray inspection of all welds 
to assure their quality (Reference 2). 

The use of welded joints can preclude the possibility of seams which 
can serve as pockets for contamination by grease, dirt, etc., which might 
not be removed in the cleaning processes prior to operation of the system. 
Passivation of the fluorine system alone is not a guarantee that problems 

including FLOX, a liquid mixture of fluorine and oxygen. 
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will not be encountered in joint areas since passivation process may not 
disturb the surface of an included grease film or particulate contaminant. 

Use of an all-welded assembly, while desirable in fluorine oxidized 
systems, poses some assembly problems and higher cost implications during 
the development, qualification and acceptance testing of the propulsion 
system. In an all-welded assembly, replacement of defective or damaged 
components becomes much more difficult and, unless the propulsion sub- 
system is designed as a totally self-contained, preassembled module,' the 
integration of the propulsion subsystem into the spacecraft can be dif- 
ficult, if not impossible. Use of Bobbin Seals, an AFRPL development 
proved successful on JPL's Feasibility Module Demonstration test program, 
for a judicious number of the mechanical joints could eliminate change- 
out difficulties and can be recommended. 

While many studies have been made of the suitability of materials 
and components for use with liquid fluorine (See the list of References), 
consideration must be given to problem areas which are characteristic of 
the fluorine systems, aside from the normal selection of materials and 
passivation. Problems may arise where motion is required between metal 
parts immersed in fluorine. 

3.4 FABRICATION AND ASSEMBLY 

It appears that the fabrication of components for a fluorine oxi- 
dized propulsion system may impose somewhat greater stringency on fabrica- 
tion procedures than is presently requires for conventional spacecraft 
propulsion system components. It may be that in some areas, such as the 

specification for allowable inclusions in nonstress bearing welds, tighter 
tolerances will be required because of the possibility of ignition of the 
included material if exposed to fluorine. Similarly voids or seams at 
joints which might be tolerated in a nonfluorine containing system would 
not be tolerable because of the possibility of retention of contaminants. 

A study will be required to determine whether or not it is desirable, 
at the component level of fabrication, to perform preliminary passivation 
of the components prior to storage. This would imply an additional cost 
above that of similar components used in nonfluorine containing systems. 
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The procedure which is somewhat different for the fluorine containing 
propulsion systems as compared to currently used bipropellant systems is 
the requirement for passivation of all surfaces which will be exposed to 
fluorine (References 2, 9 and 10). Passivation procedure takes advantage 
of the fact that most metals used in construction are resistant to further 
attack if an initial fluoride coating has been formed through a passiva- 
tion procedure. The suitability of a material for use with fluorine in 
a specific application will depend to a considerable extent on the nature 
of the fluoride film which is formed. As an example, the nickel fluoride 
film is relatively tough, tenacious to the nickel surface and impervious, 
thus permitting this metal to be used under dynamic conditions with flow- 
ing liquid fluorine. Other materials such as iron form a relatively soft 
porous fluoride film which while preventing ignition of the iron causes 
clogging of flow passages from an accumulation of solids. For this 
reason the use of iron in industrial fluorine processes is generally 
restricted to low cost systems utilizing gaseous fluorine at relatively 
low flow rates (Reference 9). Stainless steel has been used with good 
success. 

The passivation procedure for fluorine systems varies somewhat from 
user to user but in general consists of initial cleaning procedures to 
remove all obvious dirt, foreign particles, coatings, etc., followed by 
thorough flushing with a drying agent such as acetone and an inert gas 
purge (hot or cold) to remove any traces of water and solvent. In an 
assembly of components it is customary at this stage of the passivation 
procedure to conduct leak checks utilizing helium leak detection or 
pressurization of the assembly with a dry, inert gas and monitoring the 
lockup pressure. 

The final step in the passivation is the admission of low pressure 
fluorine gas, or fluorine gas mixed with inert gas in order to permit 
slow fluorine reaction with any trace contaminants left after the cleaning 
steps and to build up the protective fluoride film. Upon the completion 
of passivation, the component or assembly must be sealed to prevent any 
possible subsequent contamination. If for any reason, the component or 
assembly has to be broken into, the passivation process must be done again. 
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{. ) 3.5 FACILITY CONSIDERATIONS/RELATED ROCKET TEST EXPERIENCE 

One difference between the programs for the currently used earth 
storable propulsion systems and the proposed fluorine systems which 
causes non-recurring costs to be incurred is the necessity to provide a 
facility oxidizer supply system. This supply system is normally based on 
the use of LN 2 * jacketed tanks on the supply truck to contain the liquid 
fluorine oxidizer. This requires a periodic supply of liquid nitrogen at 
the facility to make up for the nitrogen boiloff losses from these storage 
vessels. More important is the need to provide facilities which meet the 
stringent OSHA regulations on permissible atmospheric contamination by 
fluorine and hydrogen fluoride gases. 

Requirements for protection against leakage and spills in the 
test facility are probably somewhat less stringent than the requirements 
for protection against accidents at the prelaunch and launch facilities. 

The fluorine disposal requirements may be met using essentially the same 
techniques at the launch facilities as would be used at the test facilities; 
however, the installations may have somewhat more relaxed requirements 
at the test facility. These installations are discussed below. 

3.6 PRELAUNCH 

Following a successful acceptance test of the spacecraft propulsion 
system, a number of prelaunch activities will be influenced by the use of 
fluorine oxidizers which will distinguish them from those of the current 
earth-storable propellant systems. These can be divided in two phases, 
the first are the test facility preparations for shipment and the second 
is the integration of the propulsion system into the spacecraft. 

The completion of a successful acceptance test** of a spacecraft 
propulsion system util zing fluorine provides strong assurance that there 
are no contaminants or leaks which will cause problems in the spacecraft. 
The program plan for the handling of the propulsion system after acceptance 
test poses the dilemma as to whether the post-test decontamination and 
clean-up procedures normally utilized can add to the spacecraft reliability 

I ' l 

*liquid nitrogen 

** assuming a hot firing of the subsystem at a remote site. 
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or will in themself provide possible problem areas. Post- and pre-shipment 
procedures must be examined very carefully to insure that these do not 
compromise or degrade the established subsystem reliability. 

A primary consideration is the removal of residual fluorine from the 
feed system without the reintroduction of contaminants or the removal of 
the desired protective fluoride film by the clean-up procedures. A 
means of decontaminating the propulsion system of residual fluorine 
oxidizer would be to use a dry, well-filtered, oil-free inert gas purge 
with a monitor at the purge exit to determine when all the fluorine has 
been removed from the system. Cold gas initial purging followed by hot 
gas purging will remove the residual fluorine. 

A review of standard practices indicates that it would 
be best to avoid the use of all solvents or any other form of liquid 
cleaning solutions to avoid compromising the integrity of the fluorine 
system. It may be desirable to incorporate a slight positive pressure 
within the system after it has been decontaminated to assure that induc- 
tion of external atmospheric air into the system does not take place. 

The most difficult area in which to achieve this maintenance of complete 
cleanliness will be the propulsion system injector cavities and flow 
passages downstream of the propellant shutoff valves. It may be necessary 
to cap the engine at the exit because of this problem. 

Prelaunch integration of the propulsion system into the spacecraft 
may be somewhat more difficult with the fluorine oxidizer systems than 
with the currently used storable bipropellant systems because of the 
requirement to maintain passivation in the lines discussed above, and also 
the desirability of utilizing welded joints in the feed system wherever 
possible *. 


* judicious use of bobbin seals is appropriate in practical systems. 


3-7 


3.7 PRELAUNCH AND LAUNCH LEAKAGE CONSIDERATIONS 


The above sections dealt primarily with the aspects of spacecraft 
design, engineering and test which imply criteria on the spacecraft that 
are unique to fluorine oxidized propulsion systems as compared to storable 
propellant systems. At the launch facilities, however, the primary area 
of importance is the method of dealing with leakcige or massive spill of 
the fluorine oxidizer. The current, earth storable liquid propellants, 
particularly the oxidizers such as N 2 O 4 , are reactive and toxic in moder- 
ate concentrations but are acceptable for use when proper precautions are 
taken at the launch site. The very vigorous nature of the fluorine 
reaction with most materials, including water, and its high toxicity add 
to the difficulty of providing launch operation reliability and safety. 

Malfunctions of the oxidizer system can be divided into two classes. 
The first consists of slow leaks of fluorine which permit precautionary 
measures to be taken and allow transfer of the bulk of the fluorine into 
a holding tank or disposal by other means. The second are gross leaks in 
the feed system which allow liquid fluorine to escape. 

In the first case, if leakage is sufficiently small so that only 
gaseous fluorine is escaping from the system, two problems exist. The 
first is provision for personnel safety owing to the highly toxic nature 
of the gas, and the second is the effect of the high concentrations of 
gaseous fluorine on adjacent spacecraft or launch vehicle components. 

These two problems are not greatly different then those encountered in 
the leakage of earth storable, liquid propellants. The measures presently 
utilized to assure safety at the launch facility and in the launch vehicle 
may be appropriate, allowing for the higher toxicity and-corrosivity of 
the fluorine gas. 

Adequate means of preventing the possibility of gross leaks through 
design and procedures will be essential and should be a significant part 
of the development work. 
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In examining the means for protecting against liquid fluorine leakage, 
an assessment was made of the various alternative means for rapidly 
removing the fluorine from the spacecraft tankage. One method is to use 
an overboard dump system which for ground operations would be connected 
to a sump tank to receive the liquid fluorine. This will be discussed 
in Task 4. 

The present technology for dealing with gross liquid fluorine leaks 
includes both liquid and powder forms of decontaminants. Studies have 
indicated that both offer some potential (Reference 14). In the event of 
a large spill with fire, the post-incident cleanup and decontamination 
procedures will also affect the selection of the best means of insuring 
safety. In general, while powdered materials such as sodium carbonates 
have been shown to be moderately successful as neutralizers, water in 
massive quantities may still provide the best means of insuring both 
safety and minimum damage to equipment. 

Obviously it is desirable to prevent leaks of any kind, however, pro- 
viding against the contingency could take several approaches. Considera- 
tion can be given to freezing of the fluorine with, for example, liquid 
helium in the tank cooling coil line prior to launch of the vehicle. If 
the time frame of the mission allows, the fluorine may warm up after the 
spacecraft has been detached from the orbiter stage, such procedure 
probably provides maximum crew safety for the orbiter since the frozen 
fluorine should pose no leak hazard. Internal construction of the 
fluorine tank would need to be such that damage from freezing would not 
occur. (Further study is recommended). 

One method of dealing with fluorine leaks while on orbit would be 
to eject either the entire payload or empty the fluorine tanks. Another 
alternative would be a design such that the Shuttle bay is tolerant of 
fluorine**, at least while in vacuum (at or near orbit). Obviously this 
would not be true if there was a simultaneous fuel leak. 


Through an orbiter LF 2 dump system. 
** to the degree practical 
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4. STUDY TASKS 


This section presents the statement of each Task of the statement 
of work, then describes the important considerations and results. 

Tasks 1 and 2 were combined as they related to prelaunch propellant 
loading and spacecraft processing operations. Task 6 Feasibility Analysis 
will be contained in section 4.12. The original Task 12 related to larger 
quantities of fluorine not appropriate for planetary spacecraft and was 
deleted to allow more emphasis on the hazard analysis. 

An additional task emphasizing flight safety, including the increased 
level of effort on the hazard analysis, is introduced in Task 6 and is 
presented in Appendix 9. 

4.1 TASKS 1 AND 2 S/C HATING AND PROPELLANT LOADING OPTIONS 

The requirements of Tasks 1 and 2 have been combined in this study 
because of the similarity of the tasks. Because of this similarity all 
of the requirements of these tasks are addressed most effectively via the 
Processing Sequence Comparison Study (4. 1.3. 3) and the Hazard Analysis of 
Chosen Processing Sequences (4. 1.3. 4). For a description of the method- 
ology used to answer the task statements 1 and 2, see section 4.1.2 
"Approach." The results and conclusions for Tasks 1 and 2 are found in 
section 4.T.4. 

4.1.1 Task Statements 

The task statements that are analyzed in this section of the report 
are presented below. 

Task 1. Assuming the spacecraft propulsion system is preloaded and 
pressurant bottles are prepressurized remotely, compare the mating of the 
spacecraft in the Orbiter Processing Facility versus mating on pad in the 
payload changeout facility. The comparison shall include the following 
considerations: 

a. Personnel safety 

b. Shuttle safety 

c. Effect on shuttle timeline 

Effect on spacecraft timeline 
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d. 


s. Effect on rapid turnaround for dual launch or relaunch 
following abort. 

Task 2 . Examine the feasibility of loading and pressurizing the 
spacecraft propulsion system at the pad, considering alternatives which 
include the following: 

a. On board the shuttle 

b. In the payload changeout facility at the pad 

For case (a), compare the merits of loading propellant before versus after 
installation of the RTG. Compare cases (a) and (b) with preloading in the 
Explosive Safe Faculty as has been typical for Mariner spacecraft. 

The objectives of Tasks 1 and 2 as well as for the other tasks 
are to: 

• Compare the safety interfaces between the Shuttle 
(considering both crew and hardware) and the spacecraft 
propulsion system when using liquid fluorine (LF2) 

as an oxidizer versus using nitrogen tetroxide (N2O4) 

• Identify any new and/or unique propulsion system 
requirements that would result from the use of liquid 
fluorine (LF2) as an oxidizer in the propulsion 
system of a planetary spacecraft launched from the 
Space Transportation System (STS). 

4.1.2 Approach 


To accomplish the objectives listed above for Tasks 1 and 2 of the 
SOW,* it was decided to combine the tasks and analyze them together since 
they had many common elements from an analysis and safety effects point 
of view. 

The approach taken to meet the above listed objectives and to provide 
the information required by the task statement was to perform the follow- 
ing analyses: 

• Determine the logical alternative processing sequences 
required to load propellant on the pad in the Orbiter or 
the Payload Changeout Facility (PCF), and the processing 
sequences required to mate a prepressurized and LF2 loaded 
system to the Orbiter in the OPF versus mating the preloaded 
system to the PCF then being placed into the Orbiter. 

Next establish a more complete understanding of the spacecraft 
propulsion and the associated equipment and operation. This 
includes the Mariner spacecraft, Shuttle Orbiter, IUS/TU6 
and launch facilities. 


*Statement of Work 
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* Analyze the tradeoffs to determine the merits of the various 
processing sequences from the point of view required of the 
study objectives and task statements. 

* For the most advantageous processing sequence, evaluate the 
safety and timeline on the Shuttle Transportation System in 
its normal state. 

* Next determine the required changes to the Shuttle Trans- 
portation System (facilities, equipment, Orbiter, etc.) and 
the Mariner spacecraft and the IUS/TUG, so that a space 
storable automated spacecraft may be flown on the orbiter with 
an acceptable level of risk. 

t Compare from a safety point of view the preferred LF 2 pro- 
cessing sequence with the processing of using the same 
processing sequence. 

To determine the location in this report of the answers to the various 
questions and requirements in Tasks 1 and 2, please refer to the cross 
reference matrix in Table 4-1. 

4.1.3 Analysis and Results 

4.1. 3.1 Processing Sequence Alternatives 

Tasks 1 and 2 consider alternative methods of obtaining a loaded 
spacecraft in the Shuttle Orbiter. These methods and options are shown 
in Figure 4-1. Mariner 9 is shown as a reference. The first set of 
processes described in Task 1 is the "preloading" process and the second 
set is the Task 2 "pad-loaded" process. For the preloaded process there 
are four primary options or ways that the spacecraft may be processed in 
the Shuttle Transportation System. For the pad-loaded system, there are 
two primary options defined. All of the options are shown in Figure 4-1. 
The figure also indicates which processes will be performed in each 
facility. For the referenced Mariner 9 process, the specific buildings 
and facilities are identified (e.g., ESA 60A propellant laboratory, build- 
ing AO, etc.) but for the similar operations shown for the first five 
processes of options 1 through 4 (Task 1), the specific facilities are 
not indicated, for they depend on the tractability of LF 2 with the facility 
designs and operating concepts. Designs and operating concepts for these 
facilities are defined in the hazard analysis presented in Appendix 3. 

It has been <3PL‘s intention to use ESA 60 as the loading site of the 
preloaded systems, if possible. 


Table 4-1. Cross Reference Matrix 



Section 

Task 1 



Personnel Safety 

4.1 


Shuttle Safety 

4.1 


Effect on Shuttle Timeline 

4.1 .3.5 

• 

Effect on Spacecraft Timeline 

4. 1.3. 5 


Effect on Rapid Turnaround for Dual Launch 
or Relaunch Following Abort 

4.1. 3. 5 


Task 2 



Considerations on Board the Shuttle, 
options 5, 6, 7 

4. 1.3.1 

to 4. 1.3. 3 

In the Payload Changeout Facility at the 
Pad, Option 3.4 

4.1. 3.1 

to 4.1 .3.3 

Merits of Loading Propellant Before vs 
After Installation of the RTG 

4. 1.3.1 

to 4 . 1 . 3 . 3 

Comparison of Loading in ESF vs on Pad 

4. 1.3.1 

to 4.1 .3.3 

Comparison of and LF 2 

4.1. 3. 4 



For Task 1, four options are to be analyzed. These basic options 
are described below: 

Option 1 . This payload processing sequence (see Figure 4-2) 
consists of five operations, (1) loading the propulsion module with 
propellants, (2) storing the module, (3) mating it to the space- 
craft, (4) performing checkout, and (5) transporting it to the 
next location. After the first five operations, the spacecraft 
is mated to the IUS/TUG in SAEF #2 and transported to the Orbiter 
Processing Facility (OPF) where the payload stack is rotated to 
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15) MAZE MEANS JOIN SPACECRAFT AND ITS PROPULSION 

16) INSTALL MEANS JOIN SPACECRAFT AND ORBITER 


Figure 4-1 


Processing Sequence Options 
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Remote Propellant Loading 



SPACECRAFT ASSEMBLY AND 
CHECKOUT IN EXPLOSIVE SAFE 
FACILITY (WITHOUT RTG's ) 


TRANSPORT TO OPF 
(HORIZONTAL TRANSPORT) 


.VShtF:--* 

TRANSPORT S/C TO 
SAEF 



MATE PAYLOAD TO 
ORBITER IN OPF 
(SHUTTLE TIME 70th hr) 



ERECT OR BITER (VAB ) 



MOVE TO PAD 



INTEGRATE S/C WITH 
I US IN SAEF 




CHECKOUT AND LAUNCH 


Figure 4-2. uption 1: Mate Spacecraft/IUS To Orbiter in OPF 



the horizontal position and placed in the orbiter cargo bay. 

The cargo bay doors are closed and remain closed as the orbiter 
and its payload are processed through the Vehicle Assembly 
Building (VAB), and transported to the pad on the Mobil Launch 
Platform. If de. ; red, the cargo bay doors may be reopened after 
the Payload Changeout Facility (PCF) is put in place. The 
cargo bay doors cannot be opened unless door supports are pro- 
vided at all times while they are open. The doors were designed 
to open without supports only in space. The doors cannot be 
opened in the VAB. See Figure 4-3 for facility site plan. 

Option 2 . This option begins with the same first five operations 
as Option 1 {see Figure 4-1). The propulsion system is then 
mated to the spacecraft (loaded with LFg) and to the IUS/TUG 
in the Spacecraft Assembly and Encapsulation Facility {SAEF #2); 
it is then transported directly to the pad. The payload stack 
is placed- in the PCF and mated to the PCF Payload Handling Fixture, 
and the. payload stack is mated to the Orbiter. See Figure 4-4. 

Option 3 . This is the selected option (see Figure 4-5). The 
first five operations are the same as for Option 1. The loaded 
spacecraft is then transported from the spacecraft checkout facility 
to the PCF. (The present facilities that could be used for LFg 
loading, if modified. and their locations are shown in Figure 
(4-6).) After the spacecraft (loaded with propellant) is 
installed in the PCF payload handling fixture, the spacecraft 
is mated to the IUS/TUG which was previously installed into 
the Orbiter Payload Bay. The system is checked out, the payload 
bay doors closed, then the launch is accomplished. 

Option 4 . The first five operations are the same as for Option 3. 
After the first five operations, the spacecraft (loaded with 
propellant) is transported to the PCF and mated to the IUS/TUG 
in the PCF, the payload stack is then mated to the Orbiter, and 
launched. 
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SPACECRAFT ASSEMBLY AND CHECKOUT IN 
EXPLOSIVE SAFE FACILITY (WITHOUT RTG's ) 



INTEGRATE S/C WITH 
I US IN SAEF 



TRANSPORT S/C TO SAEF 


TRANSPORT PAYLOAD TO PAD 
(HORIZONTAL TRANSPORT) 



INSTALL PAYLOAD ON PAD 
(SHUTTLE TIME 135th hr) 



INSTALL RTG'S, FINAL 
CHECKOUT AND LAUNCH 


Figure 4-4. Option 2: Mate Spacecraft/IUS (Payload) to Orbiter on Pad 
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SPACECRAFT ASSEMBLY AND TRANSPORT TO PAD 

CHECKOUT IN EXPLOSIVE SAFE 
FACILITY {WITH RTG's ) 



INSTALL SPACECRAFT, (1US INSTALLED IN opf ) 
CHECKOUT, AND LAUNCH (SHUTTLE TIME 
135 th hr) 


Figure 4-5. Option 3: Mate Spacecraft to IUS in Orbiter on Pad 
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For Task 2, there are two primary options to be analyzed. The third 
question/requirement in Task 2, shown in Figure (TBD), is analyzed as part 
of options 1 and 2 of Task 1. The basic options of Task 2 are described 
below. 

Option 5 . The spacecraft and propulsion module are received 
from JPL, assembled and checked out in building AO. The space- 
craft, with its empty propulsion system is mated with the IUS/TUG 
in SAEF #2, placed in the orbiter cargo bay in the horizontal 
position, and processed through the VAB, transported on the Mobil 
Launch Platform to the launch pad. Propellant is loaded into 
the spacecraft in the Orbiter Payload Bay with the PCF mated 
to the Orbiter and the cargo bay doors open. The Orbiter is 
then closed and launched. This option is similar to loading of 
the OMS Kits. 

Option 6 . The first three operations are the same as for Option 5. 

After the spacecraft is checked out, it is transported to the PCF 
and mated to the IUS/TUG in the PCF. The spacecraft in the payload 
stack is then loaded with propellant in the PCF. After propellant 
loading the payload stack is mated to the Orbiter, and launched. 

Option 7 . This option is similar to Option 6 except that loading 
is accomplished in the Payload Changeout Facility prior to mating 
with the IUS/TUG. 

Figure 4-6 shows the location of Explosive Safe Area 60A (ESA 60A) 
at CCAFS just west of Saturn Complex 34. ESA 60A is used for Mariner 
spacecraft propulsion loading. 

Figure 4-3 shows the KSC Shuttle Facilities Site Plan, and the 
Landing Strip, OPF, VAB and crawlerway to the launch pads. This area 
is north west of the area shown in the CCAFS map, and across the Banana River. 

4. 1.3. 2 Criteria and Assumptions 

This section describes the design, operations, and facility con- 
siderations and assumptions for option tradeoff analysis and hazard 
analysis. The chosen option is also based on the condition that certain 
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assumptions and design considerations are met so that either the 
probability of occurrence of the hazard or the effects of the hazard 
are controlled. These assumptions include: 

• System is designed so no single failure will result in a 
category I or II risk (in dynamic systems).* 

• No two human errors will result in a category I or il risk. 

c All pressure vessels around the oxidizer tank are designed 
for leak before burst, or designed and operated such that’ 
a burst is an incredible event (10-6 occurrence/launch), 
or both. 

• The F2 tank is covered with insulation, that is essentially 
compatible with LFg and protects against impacts. 

a A pressure regulated system or equivalent will be used such 
that pressure from the GHe system will not be applied to the 
tank pressure will not exceed the vapor pressure 
in the Orbiter bay. 

a The pressure of the regulated LFg tank while on the ground 
will only be about 0 psig when transported and launched. 

For the N2O4 tank pressure will not exceed the vapor pressure 
at 120°F. 

a For the LF2 system being analyzed, if complete loss of cooling 
occurs, there is up to 20 hours maximum time available for 
repair to the cooling system and for removal of the Spacecraft 
from the on-line facility to a safe area. (See Section 4.2). 

• Provision will be made to make maximum use of the flight 
spacecraft shroud or fairing as a vapor contaminant device. 


• An LF2 dewar will be provided at the launch pad to dispose of 
LF2 in case of a leak, or decision to detank, respectively, 
although normal disposition would be transportation to a remote 
site, where the LF2 would be run through a charcoal bed. A . 
charcoal bed could also be used at the launch pad. 

• Normal LF2 and N2O4 detection equipment and protective 
clothing will be provided. 


* Hazard categories are defined in Table 4-4. 

** e.g. the four tank blowdown systems shown in Figure 4-13. 
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e During loading operations, the pressure relief valve on 
the GSE (OSE) will provide over-pressure protection for the 
spacecraft propulsion system. It is also assumed that the 
GSE pressure relief is set to protect the integrity of the 
LF 2 tank. 

• Automatic alarm available when a problem occurs. (Recommended 
optional equipment). 

t LF 2 tank and other tanks around the LF 2 tank are designed to 
withstand an internal vacuum. (-j. e . one atmosphere overpressure). 

® Tank and piping adequately designed to withstand normal 
handling shock without leak. 

• All IF? will be contained in the LF 2 tank and none will be 
allowed in the piping downstream of the tank until after 
deployment. 

• There is very high assurance that the LF 2 system and support 
system is clean and there are no contaminants in the system. 

All possible measures must be taken to provide this assurance. 

• The safety control on this program is comparable to a man 
rated space program. 

• All procedures and computer programs must not have greater 
than 1 chance in a million of being the cause of a Class I 
or II hazard, (i.e. "fail operational, fail safe".)* 

• Only trained and certified personnel will be allowed to work 
on the program and adequate security must be provided. 

• Personnel access controlled. 

• Leak tested, proof tested, and passivated for a sufficient 
amount of time before loading. 

0 Extra care taken in off-line facilities, to prevent accidents. 

0 PCF payload handling fixture is capable of stacking the 
spacecraft to the IUS/TUG in the orbiter and is capable of 
performing these functions in a smooth and safe manner.** 

0 The PCF payload handling fixture is adequately designed to hold 
the payload safely even if a failure or human error occurs. 

0 The PCF will have sufficient water available to consume 3,000 
pounds of LF 2 quickly enough to prevent a Category I or II 
event. Required water flow rates are not presently known, but 
can be determined by analysis or test. 


* To state an arbitrary but specific goal. 
** or alternate technique. 
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• The Qrbiter payload bay door can be closed or open when the 
payload stack is in the PCF. Supports are required to hold 
the doors when in the open position and the fixtures are also 
used to close the Orbiter payload bay door. 

« It is assumed the spacecraft cannot be loaded with propellant 
in the PCF before the PCF is mated to the Orbiter. 

• When the spacecraft is loaded with LF2 in the PCF or the 
Orbiter, it is assumed that this operation is performed 
before propellants are loaded in the IUS/TUG on the Orbiter 
tanks. 

• Assumed a dump capability may not be proyided for the space- 
craft at all times when loaded with LF2, whether during trans- 
port or in the PCF or the Orbiter. 

e Assumed that the facility dump system at the propellant 
loading site can receive LF2 safely at any-time while the 
spacecraft contains LF2. 

t Assumed that all LF2 passed through the dump system is 
safely contained. 

« Assumed that a special ventilation system is not available to 
vent out of facility all F2 vapors and is not capable of safely 
processing the vapors removed. 

• Assumed that during all transportation operations of LF2 
between facilities, or internal to a facility, proper security 
and traffic control is provided. 

® Assumed that no LF2 transportation*operations are allowed 
unless the favorable environmental condition exist (ideally 
off-shore breeze). LF 2 should not be transported when a 
heavy fog exists or the wrong wind pattern exists. 

« Assumed that only portable (tank truck) storage facilities 
will be provided for storage and supply of LF2. 

• Assumed that standard ground and GSE and facility safety 
codes are met. 

• Assumed that a safety audit of a facility is performed 
before the facility may be used for handling or processing 
a system containing LF2. 

• Assumed that Fire Department support is available, trained 
and immediately available during all loading operations. 

i Assumed that an effective, reliable continuously operating 
F2 and HF detection system is working at all times where LF? 
or gaseous F2 is handled either at the loading site or at 
the pad. 

* of the loaded spacecraft. 4_15 


e Assumed that the PCF itself is not specifically designed 
for handling LF2 systems. 

e Assumed that much of the GSE is not protected from the 
atmosphere where the spacecraft loaded with LFg will be. 

i The viscosity of LF 2 is about the same as the viscosity 
of boiling water. 

9 Assumed that when the spacecraft is loaded with LF 2 it is 
loaded remotely. It is assumed that hydrazine is loaded 
into the spacecraft soon after the LF 2 is loaded. 

a In case of fire external to the LF 2 tank it is assumed the 
insulation material on the tank provides a time lag to prevent 
the tank from heating up too fast, that corrective 'action 
cannot be taken. 

9 Assumed that portable fire extinguishers are available at 
the PCF for small fires (not F 2 fires). 

• All precautions necessary must be taken to prevent the tank 
from rupturing, even if the rest of the spacecraft must be 
sacrificed. 

• Assumed that the SAEF #2 facility is not designed to handle 
LF2. 

• Satellite Assembly Building in ESA 60 does not presently 
have an emergency drain system for hazardous propellants. 

« The facilities in ESA-60 are not designed to handle LF 2 
system. 

• Building AO is not designed for handling LF 2 systems. 

• No gas purging will be required around the propulsion 
module which contain LF 2 while being handled in facilities 
or during transportation. 

• A cannister will be used to handle the payload stack, or the 
IUS/TUG on the spacecraft together or independently. This 
cannister is needed to install the payload stack on the 
spacecraft in the PCF. A crane on the pad service and access 
tower will be used to lower the payload from the cannister to 
the handling fixture in the PCF. 

• The facilities in area 60A and AO are not high enough to 
stack the spacecraft to the IUS/TUG. 
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• SAEF #2 is high enough to stack spacecraft to IUS/TUG but LF 2 
cannot be loaded or handled in this facility. This facility 

is very near (few blocks) from many large KSC office buildings, 
see Figure 4-7 for specific locations of facility. 

# Assumed that the LF2 tank is made out of titanium* and under 
normal conditions, the metal won't burn upon a leak unless 
heated. 


• Assumed that the majority of the LF2 system will be welded 
and where mechanical seals are used, that all metal seals' 
will be used. 

• Propellant piping will be cleaned and purged only with inert 
gas or aspirated prior to disconnecting the piping to prevent 
reactions. 

« Redundant means will be provided to prevent leaking of LF2 
through the thrust chamber of the propulsion module. 

• Assurance will be provided that all purge gases used in the 
LF2 system will themselves be purged of all moisture. 

• Redundant valves in service will be used to prevent LF2 tank 
pressurant gas from leaking into and pressurizing the LF2 tank. 

• LF2 tank pressure and temperature to be continuously main- 
tained during loading operations and after loading (storage 
and handling) 

t No dump capability is available in the VAB, OPF or on the 
Mobil Launch Platform. (These were ruled off limits anyway). 

• Assurance that on the pad, a man must be available for connect- 
ing up the i r 2 detanking system to the payload. 

• Safety philosophy in case of a rupture is to protect the KSC 
facility or shuttle arbiter at the expense of the spacecraft 
and/or IUS/TUG if necessary. 

• When the spacecraft and propulsion module or when the propulsion 
module alone is transported it is with a transporter and shroud 
and carries a supply of LN2 for continuous cooling. 

• Assumed that the propulsion module is a separate independent 
unit from the remainder of the spacecraft and it can be pro- 
cessed and checked cut independent of the spacecraft. 

• Assumed that all shuttle flight and ground systems have seen 
previous operational use when the space storable system is 
flown. 


* An important assumption confirmed by recent testing at JPL. 
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Ret 

Bldg No. 

Facility 

Sq Feet 

1 

M7-355 

Operations and Checkout Building 'Spacecraft) 

601.748 

2 

M6-342 

Central Instrumentation Facility 

136.400 

3 

M7-409 

Flight Crew Support and Training Building 

0L, 315 

4 

M7 *961 

Environmental Systems Test Facility 

10. 309 

5 

M7- 14 10/1412 

Cryogenic 1'eBt Buildings No. 1 and No. 2 

3.600 

6 

M7-1061 

Fluid Test Support Building 

11,260 

7 

M7-1417 

Ordnance Laboratory 

1,589 

6 

M7-1469 

Pyrotechnic Installation Building, now SAEF 

10, 000 

9 

M7-867 

Radar Boreaight Range 

1 135 

10 

M7-S05 

Spacecraft Spares and Equipment Building 

1. 200 

11 

M6-336 

Electromagnetic Laboratory 

186 

12 

M7-351 

Auditorium and Training Facility 

9.224 

13 

M6-138 

Communications Distribution and Switching Center 

25. 989 

14 

M6-791 

Communications Maintenance and Storage Facility 

28. 420 

IS 

M6-486 

Base Support Building 

83, 764 

16 

M6-S3S 

Heavy Equipment Maintenance Facility 

3. OuO 

17 

M7- 1210/1212 

Spacecraft System Support No. 1 and No 2 

13.000 

18 

M6-49S 

Occupational Health Facility 

14.534 

19 

M6-744 

Central Supply 

206, 630 

20 

M6-399 

Headquarters Building 

439. 44 A 

21 

M7-6S7 

News Center (Parachute Building) 

8. 2*Ju 


Spacecraft Assembly and 
Encapulation Building 


q 

I±JL 




Si* 

stmt t r 


Ref. 

Bldg No. 

Facility 

Sq Fed 

22 

M 6-339 

Communications Office 

20, 088 

23 

M6-493 

Mstn Cafeteria 

15. 449 

24 

M 6-688 

Automotive Maintemnce L Service 

17,314 

25 

M6-698 

Supply Warehouse Nu. 2 

34. 800 

26 

M6-794 

Supply Warehouse No. 1 

69. 939 

27 

M6-894 

POL Building 

10. 000 


Figure 4-7 


Location of SAEF 


• Assumed that a closed (nonvented) LF 2 system is being used 
with no safety relief valve. (Vent capped during handling.*) 

• The PCF is not needed for every launch; therefore some work- 
around operation may be performed which would allow the launch 
of the next shuttle ofn time. 

Unique NASA/DQD Safety Requirements for Shuttle Payload Propulsion 
System 


The following are NASA Headquarters unique shuttle payload safety 
requirements for propulsion systems found in "Safety Policy and Require- 
ments for Payloads Using the National Space Transportation System," 

July 1974, revised Oct 1974, prepared by the Payload Safety Steering 
Group, NASA Headquarters, Code MQ. 

• Design for Minimum Hazard . The major goal throughout the 
design phase shall be to ensure inherent safety through the 
selection of appropriate design features. Damage control, 
containment, and isolation of potential hazards shall be 
included in the design considerations (Para. 2.3, a). 

• Safety Devices . Hazards which cannot be eliminated through 
design selection shall be reduced to an acceptable level 
through the use of appropriate safety devices or part of the 
system, subsystem or equipment (Para. 2.3, b). 

« Protective Devices or provision against payload-generated 
hazards shall be provided for STS safety at all times while 
the payload is near to or installed in any element of the 
STS (Para. 4.1). 

• A safe interface between the STS elements and payloads shall be 
maintained under nominal, contingency and emergency opera- 
tions of either the STS or its payload. The safety of the 
interface during attached and/or detached operations shall 

be designed failsafe. At least two procedural operations 
shall be required for initiation of safety-critical functions. 

A hazard shall not result from any single procedural error 
(Para. 4.2). 

• The capability shall be provided for redundant transmittal 
to the Orbiter Caution and Warning System that payload which 
is critical to the safety of the STS or its flight personnel. 
The redundancy may be accomplished via hardwires and/or via the 
Orbiter PMF (Performance Monitoring Function), and it includes 
redundant sensors. The parameters to be transmitted and 
monitored will be mutually determined with the user. 

Appropriate controls for safing the payload shall be 
provided (Para. 4.3). 


*As suggested by KSC personnel . 
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• Payload safety-critical data and control functions shall be 

(. capable of being tested for proper functioning from the 

Orbiter and from the Space! ab where applicable (Para. 4.4). 

a Hazardous materials, fluids and gases shall not be released 
or ejected into the Payload Bay from payloads. Venting, 
relief and release of material from payloads shall be designed 
to use the Orbiter-provided vent system. Control of the 
venting by the Orbiter for certain mission phases may be 
reauired. Relief of inert gases under some conditions may 
be permitted. A capability shall be provided for dumping 
liauid propellants of propulsion stages and relief of pres- 
surants overboard through the Orbiter dump and vent systems. 
This shall be accomplished within the time constraints 
imposed by abort and shall be applicable with the payload 
doors open or closed (4.8). (This requirement is considered 
provisional.) 

• Redundant equipments shall be separated to prevent hazard 
propagation (Para. 4.9). 

• All safety-critical command and control circuitry associated ' 
with engine firing, primary propulsion systems or auxiliary 
propulsion systems shall be designed to accept two failures 
without causing a hazard to the Space Shuttle system 

(Para. 4.23). 

KSC Shuttle Payload Ground Safety Requirements 

Following are the unique propulsion system safety requirements found 
in "Shuttle Payload Ground Operations Safety Handbook," 14 October 1974, 
NAS 10-8583: These requirements have not been approved. 

• The payload developer shall provide for automatic switching 
to a safe mode and for a caution and warning display alarm 
for potential hazards which could result in time critical 
emergency conditions (Para. 6. 4. 1.1, d). 

• The payload developer must provide sensors to monitor the 
payload health and detect conditions potentially hazardous 
to ground operations (Para. 6. 4. 1.1, e). 

• The payload design shall provide self-safing arrangements 
for payload-generated hazards (Para. 6. 4. 1.1, f). 

■ Safety critical single failure points shall not be permitted 
in risk Category I and II (Para. 6. 4. 1.1, g). 

■ High pressure containers and pipe lines shall be protected 
against inadvertent mechanical impact (Para. 6. 4. 1.3, f). 

/ 

t T 
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■ Tanking of highly toxic or cryogenic liquid propellants 
aboard a payload vehicle must be performed as late as 
possible during launch preparations. (A waiver will prob- 
ably be given for this requirement. See next page 

on KSC safety preferences). Para. 6. 4. 3.1, d,5). 

» Water shall be available for decontamination of area and 
personnel (Para. 6. 4. 3.1, d,6). 

• Whenever pressure levels exceed 25% of the design burst 
pressure in a vessel containing hazardous fluids, the 
operation must be performed remotely (Para. 6. 4. 3. 2, d,5). 

IUS/TUG Payload Safety Requirements for Payload Propulsion System 

Following are the unique propulsion system safety requirements for 
Shuttle IUS/TUG payloads found in "Safety Requirements for Payloads to 
be Flown on Orbit-to-Orbit Stages (00S) and Tugs," Part B, Interim Draft - 
Preliminary, 30 Hay 1974: (Later data could not be incorporated) 

• Payload hazards while in orbiter shall either be controlled 
by self contained protective devices or by protective 
devices mounted on the orbiter, e.g., thermal shielding 
(Para 3, a, 7). 

■ Payload operations and energy levels shall be minimized 
while aboard the orbiter (Para. 3, a, 16). 

• All electrical, mechanical and fluid connections between 
the payload and 00S and the orbiter shall be designed to 
be failsafe (Para. 3, a,21). 

• Hazard controls shall be designed to accommodate the worst- 
case condition (Para. 3, a, 26). 

f Provisions shall be made to detect incipient failures of 
tanks containing hazardous fluids or high pressure 
(Para, 3, a, 28). 

• Payload propellant drain, and vent interface with the 
orbiter shall permit payload main propulsion system pro- 
pellant venting, and emergency detanking (whether orbiter 
is in horizontal or vertical attitude) until launch commit 
and post- landing with the orbiter payload bay doors close 
or open (Para. 3, b,4). 

■ Pressure vessels shall be fragmentation-proof (leak before 
burst), or be provided with fragmentation-proof container 
barriers. If tank pressure during prelaunch through 
deployment are kept below the maximum operating pressure, 
these requirements may be relaxed appropriately 

(Para. 3, b,9). 


X 
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■ No single operation shall result in flow of propellant 
through the payload propulsion system. The APS shall be 
inhibited while in the orbiter payload bay (Para. 3, c,3). 

• Payload propellant isolation valves shall be provided 
upstream from all start valves (Para. 3, c,6). 

• Electrical umbilical disconnects between the payload and 
the oribter and/or IUS shall be separated from hazardous- 
fluids disconnects, and shall be qualified as explosion 
proof (Para. 3, c,9). 

» Propellant tank pressures where practical shall not be 
increased to operational values until (TBD) distance from 
the Orbiter after deployment (Para. 4, p). 

IUS/TUG Propulsion System Safety Requirements 

Following are the unique propulsion system safety requirements for 
the Shuttle IUS/TUG system found in "Statement of Work, Burner II Interim 
Upper Stage (IUS) System Study," 74, July 09 (according to MSFC these 
safety requirements are typical of those to be required by DOD for other 
IUS systems): 

• Under all nominal, contingency or emergency operations: 

(1) No single failure of a dynamic system of the IUS system, 
or (2) no two (2) sequential procedural errors shall result 
in the transmission of an accident potential to or from the 
IUS system and its interfaces including flight and ground 
personnel (Appendix IV, Para. 3.1.1, a). 

• No single failure of a dynamic system of the IUS system 
shall result in an accident which jeopardizes the general 
public/ private property, or the ecology (Appendix IV, 

Para. 3.1.1, b). 

• All dynamic systems of the IUS system shall be capable of 
tolerating at least one failure before requiring mission 
termination (Appendix IV, Para. 3.1.1, c). 

• The spacecraft fill and drain line probably will not be 
allowed to pass through the IUS system (extra from MSFC). 

A kit may be allowed, so the oxidizer can be routed along 
the outside of the IUS/TUG to the umbilical. 
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4. 1.3. 3 Processing Sequences Comparison Study 


Tradeoff Criteria 

As a result of tradeoff analyses performed, it has been determined 
that the preferred option for processing a liquid F ^ system are options 
3 and 4, Figure 4-1 and 4-5. A summary of the alternatives is given in 
Table 4-2. This conclusion is based on many assumed and actual design 
and operational considerations. These considerations are presented in 
Section 4. 1.3. 2 of this report. 

Some of the key factors considered and used to select options were: 

• The hazard category and likelihood of occurrence 

• The ability to implement safety requirements so that the 
residual risks will be reduced to acceptable levels 

• Whether the hazard can be controlled in sufficient time to 
prevent a major amount of damage {category 1 or 2 risk) or 
personnel injury or death, particularly on any facility 
that would severely delay the shuttle orbiter processing. 

• NASA requirements and preferences as they are described 
in existing documentation and through discussions at the 
centers 

e The cost of implementing safety requirements 

• The impact of the hazard on shuttle timelines, rapid turn- 
arounds and relaunches 

• Inability to control the effects of residual category I °r 
II hazards 

• Whether there would be significant impact on the general 
public and the environment. 
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Table 4-2. Processing Sequence Summary Safety 


Sequence 

Eval uati on 

Reasons 

Task 1 



Option 1 

Not recommended 

1. Constrains timeline. 

2. Requires transport through non 
redundant key facilities OPF and 
VAB, i.e., unacceptable residual 
category 1 risks. 

2 

Suitable alternative 

Greater damage potential and impact 
on timeline than for option 3. 

3 

Selected as safest 

Least risks 

4 

Suitable alternative 

Greater damage impact on timeline than 
for option 3, 

Task 2 



1 

Option 5 

Not recommended 

1. Constrains timeline 

2. Large damage potential, high risk. 

3. Much greater chance for hazard 
occurring than for sequence are 
through four. 

6 

Not recommended 

1. Better than for sequence No. 5 
if PCF is not mated to Orbiter 

7 

Not recommended 

Similar to 6 
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• The RIG installation sequence. Because of the radiation 
level, personnel cannot work around RTG very long before 
the crew must be changed. 

Option Tradeoff Analysis 

On-Pad/Off- Pad Loading of Propellant . The basic tradeoff that had 
to be made was whether it is safer and acceptable to NASA to load the 
spacecraft on the pad or off the pad. All the other trades presented 
are variations of this basic tradeoff. It was determined by analysis 
and also recommended by the KSC Safety Office that the preferred process 
would be to load with propellant off the pad, then transport the space- 
craft to the pad for installation into the Orbiter. 

Loading of propellant into the spacecraft off the pad is con- 
sidered best for the reasons given below. 

The more numerous the operations, the greater the chance of a hazard 
occurring. Experience has shown that most incidents occur when propellant 
is flowing or when the system is being loaded. When loading propellant on 
the pad, there are more operations required than when handling a space- 
craft loaded with propellant on the launch pad. 

Because of space available and severe time constraints the chances 
of error during loading operations on the pad are much greater than when 
the operation is performed off the pad. Any operation that is an in-line 
function rather than a parallel function to the orbiter timeline subjects 
the Shuttle Transportation System to higher risks because of the pressure 
to meet the on-line timeline schedules. If the schedules are not met, 
the payload contractor may have to pay a cost penalty or miss the launch 
window. Time and cost constraints can produce a strong temptation to 
relax the safety requirements, thereby increasing the risks being taken. 

Due to the nature of the system the operations which occur on pad 
when handling a spacecraft loaded with propellants, fewer hazards can 
occur that are considered class I or II risks and credible or improbable 
hazards. For example, there is a chance that {estimated at about 90 
chances in a million, see Table 4-3) that a major failure will occur in 
the IF 2 tank while loading the tank off the pad or on the pad, but the 
chance of this hazard occurring on the pad when handling the spacecraft 
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Table 4-3. Reliability Considerations 




Failure Rate per 

10 6 * 

*r -i. 


Units 

Cycl es 

Seconds 

Days 

(86,400 sec 

Preliminary 

Category 

Tanks 

Pressurant Gas 


50 

0.0001 

9 

Improbable 

Propellant Liquids 

- 

100 

0.001 

90 

Improbable 

Fill and Vent, capped 


30 

- 

- 

Improbable 

(redundant) 

“ 



“ 

Improbable 

Lines and Joints, 
welded 

- 

- 

0.1 

9000 

Credible 

Disc, burst 

100 

- 

- 

- 

Improbable 

Manned Operations 
Basic 

"Foul Proof Design" 





Credible 
( 10-3) 

Improbable 
( 10-4) 


**Regu1ated system only 

* From Reliability Estimation For Chemical Propulsion System, NAS7-751, 
SRI project MSU-8075 
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loaded with LF 2 is probably very low because it may be strong and 

u 

isolated from damage. See Figure (TBD) for a brief analysis of this 
hazard. As a result of considering all the potential causes (see Appendix 8) 
of a leak occurring during handling of loaded spacecraft on the pad, 
it was determined that there would be an incredible chance (less than 
1 x 10"®) of a major rupture occurring in the LF 2 tank. It is considered 
to be more likely that a smaller leak, if any, might occur. 

At this time the LF 2 or N 2 O 4 tank would be under a low tank 
ullage pressure, approximately 14,7 psia (0 psig). The conditions that 
would be required to cause an overpressurization of the tank to cause it 
to burst when handling a loaded spacecraft on the pad generally do not 
exist as they might during filling operations. If cool down capability 
of LF 2 is lost, there are up to 20 hours available to correct the condition 
before the tank safety factor is reduced below the normal operating value. 

The analysis indicated that the probable major cause of the leak 
hazard would be external mechanical damage to the tank due to mechanical 
damage such as dropping the spacecraft during a lifting operation, etc. 

Also due to the low tank pressure, and nature of the leak, the toxic 
hazard is greatly reduced and all hazards can be more easily controlled 
if one occurs. The damage from the rupture of a tank under high pres- 
sure (which is not the case for the regulated pressure system*) is hard 
to control, and toxic release is rapid once the rupture occurs and the 
damage may be extensive. If a large leak occurs in the low pressure 
system the damage can probably be controlled and minimized and possibly 
the risk could be reduced to a Category III from a higher Category I, 
if damage to the spacecraft is not considered in the damage assessment. 

In this report, damage assessments are based on potential damage to the 
Shuttle Transportation System and the IllS/TUG but not the spacecraft 
system. With very small gas leaks, the hazard can be potentially con- 
trolled by proper design of the spacecraft shroud to contain spills if 
the spacecraft is dropped. In the PCF a special ventilation system 
could also be installed that is compatible with F 2 gas that could be 
turned on automatically and extract the evaporating F 2 and HF from the 
LF 2 spill. This ventilation system could have a high rate of flow 
and thereby could be used to reduce the toxic gas concentration in the 


* or a 4 tank blowdown system, as shown in figure 4-13. 

4-27 


facility, so that workmen could enter*. The gas that is drafted out of the 
PCF could be vented through a chimney before it is allowed to enter the 
atmosphere. It must be emphasized that the above considerations are 
based on the assumptions, requirements and conditions found in 
Section 4. 1.3. 2. 

When loading the spacecraft remotely off the launch pad, 
the system can be thoroughly passivated and checked out over a period of 
time so that it can be determined that the system is not leaking. 

The remotely loaded spacecraft is subjected to a certain amount of 
shock and vibration before being placed in the PCF; this will provide some 
assurance that the system is not too sensitive (by noting if a leak has 
occurred prior to placing the loaded spacecraft into the PCF) to the shock 
and vibration loads that will be experienced in the handling operations in 
the PCF. Implications of this experience are contained in Appendix .4. 

There are tradeoffs and risks taken with handling a loaded 
spacecraft off the pad, but overall. Options 3 and 4 are preferred. For reasons 
of eliminating other options that are within the two basic ones above, 
see the discussion on each option in the following section. See 
Table 4-2 for a summary of the evaluation of each option. 

On-Pad Loading Options (Task 2) . The three on-pad loading options 
(5, 6 and 7) are described in Section 4. 1.3.1 of this report. It is 
considered safer to load propellant in the PCF (options 6 and 7) than 
it is to load propellant in the Orbiter (option 5). Option 6 is safer 
than 7 because the IUS/TUG is not at risk. 

When loading propellant in the PCF, the damage potent : .al is less 
because the Orbiter payload bay doors can be closed during loading opera- 
tions, or possibly, the spacecraft cou'id be loaded in the PCF before the 
PCF is mated to the Orbiter. Of course, if the doors cannot be closed or 
loading accomplished before the PCF is mated to the Orbiter, the damage 
potential at the pad will be greater for option 6 than option 5, because 
the Orbiter would be severely damaged as well as the PCF, the spacecraft 


*In protective suits. 
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f and the IUS/TUG. The safety philosophy that should be used is to minimize 

the chance of a category I or II risk occurring to minimize damage and 
injury susceptibility. 

Assuming the Orbiter bay doors can be closed during propellant 
loading operations in the PCF, another advantage of loading in the PCF 
is that leaks can be detected before the spacecraft is placed in the 
Orbiter. This gives higher assurance of Orbiter protection. 

Options 5, 6 and 7 have been eliminated as candidates, in favor 
of Options 1, 2, and 3 because of the following: 

c The residual hazard of a Class I or II risk occurring when 
loading on the pad is greater 

• The nature of the hazard (any leak of N 2 °4 or LF 2 ) is 
difficult to control. 17 

0 In case a major hazard occurs, there will be a severe 
impact on the Shuttle timelines. 


Off-Pad Loading Options (Task 1) . These options are described in 
Section 4. 1.3.1 and shown in Figure 4-1. C^nce the first five operations 
are common to options 1 through 4, they are not analyzed in this section 
but will be analyzed in Section 4. 1.3. 4 of this report. The advantages 
and disadvantages of option 3 and why it is preferable over the other 
options are presented below. 

The advantages of option 3 are: 

e The transportation of the loaded spacecraft directly to the 
launch pad in an environmentally protected enclosure pre- 
vents the personnel in the OPF and VAB from being exposed 
to the LFg potential hazards as they could be in option 1. 

i The spacecraft is not subjected to as many operations and 
stresses as it would be in option 1. The spacecraft can 
always be held in the vertical position. In option 1 it 
is rotated more than once. 

0 The residual damage potential is not nearly as great as it 
is in option 1 since fewer facilities are at risk. 
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• The advantages of option 3 over option 2 is that if a 
major hazard {spill, or major leak) occurs, less damage 
will be incurred, because only the spacecraft will be . 
damaged and not the I’lS/TUG. Other advantages are (1) the 
SAEF #2 facility does not have to be refurbished to be 
compatible with handling LF 2 systems*, (2)’ the KSC 
offices and industrial area that is located near 
to SAEF #2 will not be exposed to the hazards; 

(3) the chance of external mechanical damage occurring to 
the LF 2 system is greater when handling the more cumber- 
some and heavier payload stack than when handling the space- 
craft alone, and (4) the IUS/TUG may have some items that 
are hazardous to the LFg system and be the cause of a 
category I or II risk (e.g., if any the pressure vessels 
or batteries are pressurized during handling operations). 

b The advantages of option 3 over option 4 are that fewer 
items are subjected to damage if a hazard occurs in the PCF 
(i.e., in option 4 the TUG/IUS would be damaged in addition 
to the PCF). The chance of a hazard event occurring is 
greater for option 4 than for 3 because of the size of the 
payload stack, its weight, and additional potential hazards 
the LF 2 system is subjected to form the IUS/TUG itself. 

Option 4 is viable approach, however. 

The Shortcomings of Option 3 are: 

8 The spacecraft loaded with LF 2 is processed through facilities 
that are not yet designed to handle liquid LF 2 systems nor 
is the electrical equipment, or personnel located in the 
facilities properly protected from the LF 2 hazard. One of 
the concerns expressed at KSC is that electronic control 
equipment will not be protected from a small leak in the 
LF 2 system; it was stated that solid state circuits, and 
microelectronic circuits can be damaged by concentrations 
of F 2 gas and HF in the air at less concentrations than the 
allowed TLV of 0.10 PPM. 

8 To process the LF 2 loaded spacecraft through the first five 
locations in the off-pad options the facilities 
(ESA 60 propellant laboratory, assembly and, storage build- 
ing, etc.) will have to be modified so that they will 
be capable of handling systems or a completely new LF2 
dedicated facility constructed. At the present time, 
the above facilities are not equipped for handling LF 2 
systems. A new facility could be so equipped. 

8 There is a chance of major damage to the PCF and orbiter 
when handling the propellant loaded spacecraft in the PCF 
and orbiter if a hazard occurs and if the proper design, 
operations and personnel requirements are not adherred to. 
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« The present (ESA, etc.) facilities that would be used are 
located a significant distance from the PCF and because of 
this the LF^ system is subject to more external hazards than 
may be necessary. See Figures 4-3 and 4-6 for location of 
facilities. To assure public safety, only safe back roads 
should be taken to the launch pad. 

4. 1.3. 4 Hazard Analysis of Preferred Processing Sequences (for LF2 nd 

S3 

The objective of the hazard analysis of the preferred option 
(option 3) (see Section 4. 1.3. 2) is to determine the hazards from fluorine 
to the Shuttle Transportation System (STS) (including personnel, facilities, 
orbiter, etc.) Also, an objective was to determine the effect the hazards 
would have on the risk of injury, death and damage, and what changes would 
be required in the STS, Mariner Spacecraft, and the IUS/TUG such that a 
liquid fluorine system could b<* flown on the STS and handled at AFETR 
and KSC within an acceptable level of risk. The guiding criteria for this 
study are that in assuring ground and flight personnel safety, that "the 
confidence shall be equal to or greater than that which exists today for 
NASA space programs." Section 4. 1.3. 2 of this report may be used as a 
guideline for determining the acceptable level of risk NASA Headquarters, 
KSC, MSEC, and JSC are willing to take. 

The TRW interpretation of these requirements is that "the chance of 
a Category II or greater accident (hazard occurrence) shall be reduced 
to an incredible liklihood for each operation of a single launch." 
(Definitions in Table 4-4.) Category II is defined as damage in excess 
of $100,000 or severe personal injury and incredible liklihood is defined 
as less than 1 chance in 1,000,000 per launch. See Note 1, next page. 

In general, NASA does not want to have a residual hazard that could 
be the cause of credible category I or II condition. 

A general review (Section 4. 1.3. 3) of the potential hazards that 
may exist if option 3 is instituted reveals that if the present STS is 
used as-is there are several hazards (e.g., spill of LF 2 , leaking F 2 gas, 
etc.) that would not be sufficiently controlled nor would the risk taken 
be sufficiently low. For example, it has already been indicated by KSC 
Safety, that the use of the Propellant Laboratory (ESA-60) in the Explo- 
sive Safe Area may not be acceptable as-is for processing an LF 2 stage. 
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Table 4-4. Terms Used in Estimate^ 1 ) 


Term Definition 

Category IV - Minimal Damage, no injury 


Category III - Minor Damage ($10K-100K), minor injury. Shuttle turnaround 
delay >3 days 

Category II - Serious Damage ($100K-500K) , ( 2 ) serious injury. Shuttle 
turnaround delay 3 days 


Category I - Major Damage, death 


Credible event 
Improbable event 
Incredible event 


ROM i Li kli hood 
( > 10“ 3 /launch ) 

( < 10~ 3 to 10 6 /launch) 

( < 10" 6 /launch ) 


Type of Activity 

Activities subject to human error, 
e.g. temporary connections 

Activities subject to equipment 
fail ures 

Activities involving previous 
similar activities which prove 
adequacy - e.g., structural i : 
integrity 


Residual hazard - Hazards which cannot be eliminated or controlled by 
automatic or manual backup operations and/or safety monitoring provisions 
for other equipment. 


1 It is understood that these categories and/or their use iray not agree 
exactly with those used by others. It was judged most useful for this 
study to use these categories to get optimum resolution in the hazard 
analysis. It was also deemed necessary to assign liklihoods so that 
personnel of various disciplines could communicate in as rpecific a 
manner as possible. 


2 Or over TOOK damage to ESF propellant laboratory or payload changeout 
facility. 
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To determine other changes that would be required at KSC and to 
the orbiter to handle LF 2 , a "hazard analysis" was performed for option 3. 

The basic elements of the "hazard analysis" are as shown in Appendix 8 
"Mariner/Shuttle Oxidizer Hazard Analysis." The analysis was performed 
for a Mariner type spacecraft which uses LF 2 as an oxidizer and a Mariner 
type spacecraft using N2O4 as an oxidizer. It is assumed that both space- 
craft will be processed through the same facilities. These facilities 
are indicated in the processing sequence diagram (Figure 4-1 ), option 3. 

The processes and facilities that are analyzed are similar to the pro- 
cesses and sequences normally used by Mariner type spacecraft (see VO-' 75 
Reference process sequence in Figure 4-8).* The only major difference 
in the option 3 processing sequence and the normal Mariner processing 
Sequence is that the spacecraft will be installed in the Payload Changeout 
Facility, then inserted into the orbiter cargo bay onto the IUS/TUG. 

Normally the Mariner Spacecraft is hoisted directly over on the top 
of the launch vehicle from the spacecraft transporter and lowered onto 
the launch vehicle with an overhead crane. 

A unique feature of the hazard analysis is that two levels of risk 
are evaluated for an LF 2 and an N2O4 spacecraft system. The first set of 
risk categories (column 7 of Appendix 8) is estimated based on an LF2 
spacecraft system processed at KSC, assumptions include processing option 
3, use of the present KSC planned facilities, STS Orbiter design, 
and present IUS/TUG concepts, STS operational concepts and procedures. 

The second set of risk categories (column 10 of Appendix 8) indicates 
the reduced risks that will result if anticipated safety controls 

(column 11 of Appendix 8) are implement:, and operate effectively. It 
should be recognized that if the recommended safety controls in column 11 
are changed, the level of risk taken is changed accordingly. Also there 
may in some cases be more than one level of risk for a particular hazard: 

For example, it is possible to kill yourself by falling off a desk, but it is 


*Viking (Mariner class) spacecraft launched in 1975 
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Figure 4-8. VO '75 Propulsion Subsystem E, Schedule and Facility Usage 


















not likely to occur. In the hazard analysis if it is possible to have a 
residual category I hazard it will be indicated, but the most probable 
risk will also be indicated first. 

In addition to determining the risk category (amount of damage, 
injury, or schedule slip) taken, the causes of the hazard/risk and their 
chances of occurrence are evaluated in the hazard analysis. The evalua- 
tion or chance of occurrence of hazards is based on engineering judgment, 
experience, over eight years of TRW test experience, and the experience 
of many other companies (which was obtained by a literature survey). The 
chance of a hazard occurring was placed into „he following three classes: 

• Credible hazards - estimated to be greater than 10“3 chance 
of occurring 

t Improbable hazards - between 10“3 and 10" 6 chance of 
occurring 

• Incredible - less than 106 chance of occurrence 

With the level of risk taken and the chance of the hazard occurring 
known, it can readily be determined if the particular operation of concern 
is acceptable. 

In general, it is believed that NASA, will not accept a category I 
risk that has a Credible or Improbable (as defined above) chance of 
occurring. 

See Appendix 8 for the detailed hazard analysis for Option 3 of 
Figure 4-1 . 

4. 1.3. 5 LFg and N2O4 Comparison 

Safety Comparison Methodology 

The purpose of this section is to provide the answer to objective (a) 
in Section 4.0 of the Statement of Work (Exhibit 1) for Tasks 1 and 2. 
Objective (a) is "to compare the safety interfaces between the Shuttle 
(considering both crew and hardware) and the spacecraft propulsion 
system when using LFg as an oxidizer versus using N2O4." 

This objective was met for Tasks 1 and 2 by using a logical process 
of analysis. The process used was to first perform the "Processing 
Sequences Comparison Study" which is presented in Section 4. 1.3. 3 of this 
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report. The next step was to perform a hazard analysis on the preferred 
processing sequences which is presented in Section 4. 1.3. 4. Then it 
was determined (from the hazard analysis) which hazards during which 
operations presented the highest risk to the Shuttle program when handling 
and processing a liquid fluorine system. This was determined by reviewing 
the hazard analysis to determine where all the risk Category I and I 
(possibles) and in some cases where Category II and II possibles appeared 
un the modified Shuttle system. The next step in the ^0^ comparison study 
was to assume that a spacecraft containing was processed through the 
same operations and conditions where the highest risk categories appeared 
for handling an LFg system. A review of the hazard analysis in Appendix 8 
revealed that the worst conditions for equipment and facilities were when 
a 1-inch equivalent leak of LFg occurred in task 1-18, "Install spacecraft 
in PCF, " and in task 1-19, "Install spacecraft in the Orbiter." (A tank 
rupture was not considered credible.) From a personnel point of view, the 
greatest risk occurred during loading operations (task 1-2, “Load propel- 
lant, Dedicated LF^ Facility") of the LF£ in a safe area away from the 
launch pad and other important KSC and AFETR facilities. 

Once it was determined which operations were to be evaluated and 
compared, a hazard characteristics table was developed for the N 9 0 fl hazard 
and the LF 2 hazard. This table is presented in Table 4-5; the information 
from this table is used to determine the potential extent of damage that 
might occur if the 1-inch equivalent leak hazard occurs for either 
or LF 2 . The hazard characteristics table was also used to evaluate the 
damage control characteristics of the hazard. 

An evaluation was also made of the chance of the hazard occurring for 
both the and LF 2 hazards. This was determined so that the chance of the 
hazard occurring as well as the level of risk would be known, and a proper 
comparison could be made. 
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Table 4-5. Risk I and II Hazard Comparisons For NgO^ and LFg Spacecraft System 


Hazard 


LF2 Spacecraft System 


N2O4 Spacecraft System 


One-inch equivalent 
^leak in orbiter 
cargo bay. Item 
No. (2) of 
Hazard Analysis, 
sec. 4. 1.3. 4 

Appendix page A-43 


Chance of Damage Potential, Damage 

livalent Hazard Control , Hazard Character 

ter I 

I tsm 

Less than for • When the leak occurs due to 
• N2O4 system an external hazard, the 

’ ! because less first effect will be a de- 

i sens iti ve lay because the tank 

ie A-43 j external hazards pressure will probably be 

because of system less than atmospheric. After 

design, i.e. 3" a few seconds, the LF2 will 

closed cell foam flow out of the tank by 
insulation and gravity flow as water 

double wall tank through an orifice. 

When the rupture fi rst 
occurs, it will be detected 
j by pressure transducers in 
the tank and the aspirator 
| of the "catch pan" * will be 

activated. The spilled LF2 
will then be contained in 
the "catch pan" system. The 
1 boil -off of F2 vapors will 
j also be aspirated into the 
"catch pan" system. Some F2 
gas will probably escape and 
cause a small amount of 
corrosion to the orbiter. 

The S/C may be 
destroyed. The IUS/Tug will 
be protected by a barrier. 

c Not anticipated that there 
will be a significant fire 
if aspiration is provided 

* catch pan concept could be combined with a double wall tank. 


Chance of 
Hazard 

Greater than 
for LF2 system 
because of 
being more sen- 
sitive to ex- 
ternal hazards 
such as fire, 
and mechanical 
damage . 


Damage Potential, Damage 
Control , Hazard Character 


e The N2O4 will spew out of the 
tank spraying the orbiter 
cargo bay and the plastic bag 
on the inside surface of the 
cargo bay. The plastic sur- 
face may ignite and a fire I 
may result. If there is no 
fire, there may be extensive 
corrosion of the Orbiter. If 
spill occurs after the 
orbiter and IUS/Tug is loaded 
an explosion hazard 
may result and if ignited, 
the entire orbiter mav be 
destroyed. (No catch pan for N2O4) 

• The fire could be controlled 
by a heavy deluge of water, x 
but the damage would be ex-' 
tensive. At the present time, 
a sufficient amount of water 
is not being made available 
at the PCF or in the cargo 
bay for fire fighting. 


• Anticipated that there will 
be an extensive amount of 
cleanup required and the 







Table 4-5. Risk I and II Hazard Comparisons For N 2 0^ and LFg Spacecraft System (Continued) 


' Hazard 

" ' ' ' ' 

LF 2 Spacecraft System 

N 2 O 4 Spacecraft System 

continued 

- 

' 

j ‘ ■ 

■ 

• 

• . . ! 

i , : 

| . . , I 

Chance of 
Hazard 

Damage Potenti al , Damage 
Control, Hazard Character I 

Chance of 
Hazard 

Damage Potential, Damage 

Control , Hazard Character 

.... ... 

. 

- 

• Impact on time line depends 
on the amount of damage in- 
curred to the orbiter due to 
escaping F 2 gas and fires. 
Because of plastic in the 
cargo bay, a major cleanup 
may be required and the 
orbiter would probably have 
to be taken off the launch 
pad and refurbished. 


orbiter would have to be 
refurbished before use. 

c ' ■ 

! One-inch 
equivalent leak 
in the PCF. Item 
No. (4), 

Hazard Analysis, 
sec. 4. 1.3. 4 

Appendix page A-47 

i 

i 

.Less than for N 2 O 4 
system because it 
is less sensitive 
to external hazard: 
because of system 1 
design. 

[ The chance that th« 
j hazard will occur 
1 duri ng pi acement 
of the S/C into 
the PCF should be 
low because: 

1. The tank is i 

Well protected 
with shock absor- 
bent insulation. 

2. The LF 2 system 
is designed to 

j take the shock & 

• The damage potential that 
can result from this hazard 
is greater than when the 
hazard occurs in the orbiter 
because at some times (e.g. 
when lowering the S/C into 
the PCF and when placing it 1 
into the orbiter) there is 
not equal control of the 
hazard when it occurs. The 
''catch pan" will only be 
used when the S/C is 
attached to the PCF handling 
fixture. 

• The max. damage potential 
that can occur to the PCF is 
a level II risk, or indi- 
cated in the risk category 
definitions presented in 
Figure 

Greater than for 
LF 2 system be- 
cause of being 
more sensitive 
to external j 

hazards such as 
fire and mech- 1 
anical damage, | 

i 

t 

\ 

i 

1 

1 

j 

i 

; 

J 

• See Note 1 . 

• A spill may occur at any time 
during handling of the S/C in 
the PCF. If a leak occurs, 
the major damage as a direct 
result of the leak will be t 
extensive damage to electronic 
equipment, extensive corrosion 
of incompatible materials and 
possibly some small fires. 
Major hazard to personnel if 
they do not wear a "Scape 
suit ! 1 during the handling 
operations as is required of 
personnel during handling of 
the LFo system. Personnel may 
.be killed or severely injured 
by the toxic vapor. 







Table 4-5. Risk I and II Hazard Comparisons For ^0^ and LF2 Spacecraft System (Continued) 


Hazard 

LF2 Spacecraft System 

N2O4 Spacecraft System 

- ‘ , V ■ i 

Chance of 
Hazard 

Dam 7 'e Potential , Damage 
Coiiu.^1, Hazard Character 

Chance of 
Hazard 

Damage Potenti al , Damage 
Control, Hazard Character 

handling Toads 
without a leak 
occurring. 

3. The chance of 
the S/C being 
dropped is very 
low, for the de- 
sign & handling 
procedures will 
be reviewed to 
assure that the . 

, chance of dropping 
the S/C is incred- 
ible. 

4. The S/C will be 
protected from all 
known external 
hazards. 

5. The S/C propul* 
sion tanks are noi 
under pressure. 

6. The hydrozine 

tank wil 1 be de- 
signed to leak 
before burst. i 

(or relief) 

• If a leak occurs during 
placement of- the loaded S/C 
into the PCF, a major amourt 
of damage will be incurred 
(level II risk or less). 
During the operation when 
the hazard occurs, the cargo 
bay doors of the orbiter 
will be closed. A major 
fire will result and all 
personnel will have to leave 
the area. The PCF should 
then be moved away from the 
orbiter, so that the orbiter 
will not be damaged. 

• The time interval in which 
the hazard may not be ade- 
quately controlled is small, 
i.e., the time it takes to 
lower the S/C into the PCF. 

• Once the leak occurs, a fire 
will start and be sustained 
until the F2 is exhausted . 

• The size and length of the 
fire does depend on where 
the leak occurs in the tank. 

• The effects on personnel out- 
side of the PCF and inside • 
the PCF at the time of the 
hazard are described in the 

j 

i 

* 

\ 

• If there happens to be fuel 
vapors in the area, there is a 
chance of a major explosion 
occurring which would destroy 
the PCF and cause major damage 
to the orbiter even if the 
doors are closed. The damage 
potential of N2O4 is much 
greater than for the LF2 if 
the explosion occurs; the LF2 
will not contribute to an 
explosion as severly as N2O4 

• The chance of a large fire is 
less with N2O4 than LF2, if 
assuming an explosion does not 
occur. 

• The ability to minimize the 
extent of damage is better 
for N2O4 than for LF2, if an 
explosion does not occur. The 
N2O4 may be cleaned up before 
a major fire occurs. 

• A large amount of water is 
needed to dilute the N2O4. A 
possible problem may be that 
the water may not be available 
to the PCF in the quantities 
needed, which means that the 
chance of an explosion is 
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Table 4-5. Risk I and II Hazard Comparisons For N 2 G 4 and LF^ Spacecraft System (Continued) 


Hazard 

LF 2 Spacecraft System 

N 2 O 4 Spacecraft System 

I ' ■ . . 

• , 

' 

S . 

f ; , ^ ' 1 

NOTES: (D 11 

Chance of 
i Hazard 

Damage Potenti al , Damage 
Control , Hazard Character • 

Chance of 
Hazard 

Damage Potenti al , Damage 
Control , Hazard Character 

. 

" 

l: 

r 

t 

is assumed that a 

5 

Hazard Analysis in section 
2. 1.3. 4 of this report. 

« If the hazard occurs at other 
times In the PCF than when 
being lowered in the PDF, the 
hazard should be well con- 
trolled by the "catch pan" 
and a specially designed 
ventilation system to take 
out toxic & corrosive vapors. 

• As a result of the leak dur- 
ing lowering of the S/C into 
the PCF> the electronic 
equipment in the facility 
would probably be severely 
damaged. 

'catch pan" is not designed for 

‘ 

! 

• 

. 

:he N 2 O 4 system. 

0 

' 

! 

greater than it would be if 
the water were available. 









Hazard 


Major spill in the 
facility used to 
fill tanks with 
propellant. 

Item No. 2, 
sec. 4. 1.3. 4 
Appendix page A-44. 


Chance of 
Hazard 

Chance of incident 
happening is great 
er during this 
operation than on 
the pad. See 
Figure ( ) for a 

list of causes 
and chances of 
occurrences . 


Damage Potential , Damage 

Control , Hazard Character 

• See Note 2 

• A major spill would result 
in a major fire and a very 
hazardous toxic environment. 

• The spill would mainly be 
controlled by stopping the 
flow of Tiauid, if possible, 
by using propellant drain 
system to get rid of some 
of the propellant and by 
applying a water fog to 

the liquid fluorine so 
that the 9F 2 may be consumed 
with low heat release. 

• Disaster control around and 
in the facility will be a 
major problem if this in- 
cident occurs. 


Notes : (2) Its is assumed that the facilities, 

handle LF 2 or N 2 (V. 


LF 2 Spacecraft System (Continued) 
N 2 O 4 Spacecraft System 

Chance of 
Hazard 


See Note 2 

» A major spill would present 
a major toxic hazard to per- 
sonnel for personnel may be 
exposed to hazardous gases 
and not know it and injury 
or death may result. 

•Fire may result but it can be 
controlled with large quan- 
tities of water. 

• If fuel vapors are present 

a major explosion hazard may 
occur, for the ignition so 
source probably will be avail 
able. If this happens major 
damage to the facility willx 
probably result and personnel 
may be injured or killed. 

• A propellant drainage system 
can be provided which would 
minimize the effects of the 
spi.ll. 


are designed to 


Damage Potenti al , Damage 
Control , Hazard Character 








Table 4-S. Risk I and II Hazard Comparisons For and LFg Spacecraft System (Continued) 


Hazard 


LF2 Spacecraft System 


N2O4 Spacecraft System 


Chance of 
Hazard 


Damage Potential * Damage 
Control, Hazard Character 


Chance of 
Hazard 


Damage Potenti al , Damage 
Control , Hazard Character 


• F 2 vapors will cause 
significant damage to the 
facility and possibly equip- 
ment in the facility. 

•Personnel not properly 
protected probably wor. 1 1 
be able to enter the area 
due to the irritating 
nature of the F 2 gas at low 
levels of concentration. 








LF2/N2O4 Hazard Comparison 

The results of the hazard analysis comparison are presented in 
three sections. The first section is the comparison of the hazards in the 
orbiter cargo bay, the second is the comparison in the PCF, and the third 
is the comparison in the loading facility. 

For the LF 2 spacecraft system the conclusions drawn are based on the 
assumptions listed in Section 4. 1.3. 2 of this report and on the safety 
controls recommended in the hazard analysis Appendix 8. It cannot be 
emphasized strongly enough that the comparisons are based on the assumption 
that the LFg spacecraft is very well ^designed from a safety point of view. 
This also includes the design of the operations, procedures and computer 
software. In general, it is assumed in this analysis that these elements 
are designed so well that there is less than one chance in a million that 
the basic design of the spacecraft, operations, procedures, and software 
will cause a class I hazard. The hazards that are evaluated and compared 
to N2O4 have been evaluated and it has been determined that for the causes 
mentioned in the hazard analysis that there is greater than one chance in 
a million of the hazard occurring. This is mainly due to the influence 
of external hazards on the LFg and N2O4 system. 

The assumed N2O4 and LF2 spacecraft system design characteristics 
that have a direct impact on the system comparison are: 

N2O4 Spacecraft System 

• The N2O4 liquid is at approximately the ambient environmental 
temperature 

• The nominal pressure in tank is 15 psia. 

■ The tank is vented at about 110% of the tank operating 
pressure. 

• The amount of tank insulation is much less than that required 
for LF2; the tank pressure will be sensitive to external 
fires. The tank insulation does not provide much protection 
from mechanical damage. 

LF 2 Spacecraft System 

• The LF2 tank is well insulated thermally 

• The thermal coating on the LF 2 tank is shock absorbent 
*i .e. to the best known state-of-the art. 
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I _) a The LF2 is cryogenic 

• The tank pressure is equal to, or less than atmospheric 
§ The LF2 can be cooled down below its N.B.P.* 

• The tank insulation provides for significant tank protection 
from external fires. The insulation is not flammable in air. 

• The spacecraft system is designed to incorporate a shroud 
which has containment capabilities. 

• The tank can do without cooldown for 5 to 10 hours before 
a significant pressure buildup in the tank occurs 

• The LFg system is a not vented 
LF2/N2O4 Hazard Comparison Conclusions 

It has been determined, based on all the assumptions previously 
mentioned, that LF2 is safer as compared to N2O4 when handled in the PCF 
and when installed in the orbiter just before lift off. This conclusion 
at this point of the study, is for ground operations only. During 
servicing (loading) of the spacecraft with propellants, N2O4 is considered 
'■ safer from a facility point of view but LF 2 is considered safer from a 

per f unnel point of view.' This is because of the inability of personnel, 
by their natural senses, to be aware that they have been exposed to a 
r hazardous concentration of N2O4 vapors. 

1 1 4. 1.3. 5 Timeline Effects 

f The assumed timeline is shown in Figure 4-9a. On the right side 

l of this illustration, the safety impact on the timeline is noted. 

I , For the selected option, option 3, the assumed assembly processing 

i 1 * * 4 operations at the launch site are as follows: 

i. 9 It is assumed that the IUS or TUG, whichever is used, will 

be installed in the cargo bay of the orbiter in the Orbiter 
Processing Facility (OPF) in a horizontal attitude and will 
j; be rotated within the vehicle in the Vehicle A'sembly 

Building (VAB) and transported to the launch pat (39A or B). 
It is assumed that it will have an interstage truss installed 
if' in the OPF.** 

1 * Normal boiling point 

| : ** Although this is not longer current, there is no difference in the 

J result shown on page 4-45. 
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CONNECT LN 0 
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Figure 4- 9a. 


Launch Pad Operations, Payload Installation 
On Pad, and RTG Installation on Pad 



o If a solid propellant kick stage is used, it will be installed 
with an appropriate thrust cone to the interstage by use of 
the Payload Chargeout Facility so that a safety hazard from 
the solid rocket will not exist in the OPF or VAB. This may 
compromise the timeline as the PFC will not be available to 
accommodate the spacecraft and its propulsion until after the 
solid rocket is installed. 

• When its upper stage(s) are ready, the spacecraft will be 
transported to the pad and hoisted into the PCF (and cooling 
reconnected in the case of LF 2 )* Approximately 1 hour time- 
line delay for clear pad operations, and an additional hour 

if LFg to reconnect LNg cooling for LF 2 the pad may be cleared 
prior to rollup of the transporter. 

• The spacecraft will be installed within the cargo bay by the 
equipment in the PCF (1 hour). 

■ The spacecraft will be joined at all disconnect points 
through its field joint (interface) to the IUS/TUG. Recon- 
nected through the lines which enter the carqo bay via the 
T-0 umbilical). 1 hour plus 1 hour to reconnect, tiext LN2 
cooling will be resumed and check-out of the GH e prechill 
cooling mode is to be accomplished. 

• When cooling of the fluorine tanks (if any) has resumed, 
pressure and electrical check-out of the spacecraft to 
IUS/TUG interface is appropriate. 

• If the flight has fluorine propulsion and carries a Dump Kit 
Peculiar, Fluorine (DKPF) line from the spacecraft interface 
through the orbiter, it is next passivated with gaseous 
fluorine, and "blanketed" with dry GH e (1 hour) 

• It will be assumed that any radioisotope heating units 
(RHUs) (such as on the spacecraft fuel tanks) and the RTGs 
are installed (prior to arming the solid rocket, if one is 
used). 

• The raps on the spacecraft propellant vent/ relief lines are 
removed. 

• The Shuttle Orbiter 's doors are closed 

• Other operations preparatory to launch are accomplished as 
shown in Figure 4-9b including cabin closeout, vehicle 
external tank propellant servicing (loading) and IUS/TUG 
hypergolic servicing (loading) prior to launch. 

• At sometime prior to scheduled launch. , after the doors 
are closed, the LF? cooling may be changed from normal LN;? 
to GHe prechi 11 mode to provide greater heat soak capability 
in the propellant. 
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Figure 4-9b. Launch Pad Operations* Payload Installation On Pad, 
and RTG Installation On Pad 




Thus it can be seen that the safety effect on the Shuttle timeline 
is 6 hours for N2O4 and 9 hours for LF2, the extra time being required 
for connection of the cooling lines. 

The main effect on the spacecraft timeline is that the spacecraft 
propulsion system must arrive about 1 month early so that it can be stored 
after propellant loading. 

The selected option, option 3 , is the most suited to rapid turn- 
around as it requires the least disassembly and reinstallation with the 
least timeline interruption. It would also appear most suitable for dual 
launches from the same pad or for relaunch following abort. 


4.2 TASK 3. EXAMINATION OF LF 2 TEMPERATURE CONTROL ALTERNATIVES 
4.2.1 Task Statement 


The task statement is: 

Determine methods by which the LF 2 temperature (nominally 85 + 6°K) 
can be maintained while on the ground, during ascent, and during 
abort including the post-landing phase. Compare the alternatives 
in terms of operational simplicity and shuttle safety. 

4.2.2 Baseline Approach 

Temperature conditioning of the propellant within reasonable 
temperature limits is needed to prevent over-pressurization of the tank. 
The baseline approach is to insulate the tank with approximately 2 inches 
of polybenzimidazole (PBI) closed cell foam to prevent icing of the tank, 
to keep it chilled with liquid nitrogen (LN 2 ) near the LF 2 normal boiling 
point until just prior to flight, then subcool it approximately 25°F from 
-305° to -330°F with cold gaseous helium. With this subcooling, the 
systems have the following allowable heat-up times shown in Table 4-5. 
(Other system characteristics are shown in Table 4-6) 


Table 4-5. Heat-up Time (to Tank Design Pressure)- Hours 


System - 700 lb LF 2 
(as per Table 4-6) 

No Prechill 

Double Insulation or 25°F 
Prechi 11 

2 Tank Blowdown 

3 

6 

(Figure 4-6) 

Regulated (Figure 4-7) 

6 

12 (20 hours 

4 Tank Blowdown 

6 

with prechi 11 and additional 
insulation) 

12 (20) 


*JPL Communication to TRW September 10, 1974, A.N. Williams to 
W.L. Davenport.: 
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Table 4-6. System Characteristics 



4 T ank Blowdown 
Regulated 

2 Tank Blowdown 

Fluorine propellant mass, kg lb 

318/700 

318/700 

Tank design pressure, bar/psi 

191/420 

191/420 

Initial pressure, bar/psi 

10.9/16 

21.7/320 

Pressure rise, bar/psi 

27.5/404 

6.8/100 

Heating rate, Q c/sec//°F/sec 

2.2/4 

3.9/7 with the tank 

Allowable rise, °C//OF/sec 

14/25 

12/22 


These systems are very similar to the one previously analyzed by TRW 
in Contract NAS7-750. A comparison of the above data with that analysis 
indicated that the data above may be conservative. The analysis from that 
study is quite pertinent for a system of 1800 lb LF 2 weight and the dis- 
cussion of ground hold thermal analysis is incorporated as Appendix 5. 

The flight transportation environment is similar to the ground hold 
situation as temperatures on the ground and in the cargo bay are similar. 

Alternate methods are summarized in Table 4-7, Temperature Control 
Methods . 

Since the time specified for deployment is specified as one phasing 
orbit plus three additional orbits, approximately 6 hours are needed for 
deployment. The 2 tank blowdown system is thus marginal, unless it is 
both prechi lied and double insulated. 

The externally pressurized system has a safety factor on time of over 
3.6:1 and is considered quite reasonable. This is especially true if a 
dump system is available. 

A comparison of safety and simplicity of the alternatives is shown 
in Table 4-8. This comparison is by mission phases. Table 4-9 summarizes 
the comparison. These comparisons assume that vent and dump are not per- 
mitted and the system is independent. Vent and dump are backup (safety) 
modes which incapacitate the mission. 
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Table 4-7. Temperature Control Methods 


Method 

Description 

Comments 

Insulation 

Approximately 2" ’of PBI foam 
insulation to prevent icing 

Selected - appears 
essential 

Thermal inertia-LF 2 

Inherent heat capacity of 
the LF 2 and its tank • 

Selected - inherent 

Thermal inertia-GHe 

Heat capacity of the prss- 
surant GH 2 and its container 

Can be “heat sunk" to 
LF 2 tank 

GHe relief cooldown 

Cooling effect of emergency 
pressurant blowdown — may 
use heat exchanger or not 

Small effect - only 
good for emergency use 

LNg carry along 

Auxiliary LN 2 dewars ground 
based or flight 

Back-up approach - flight 
dewar creates hazards** 

GHe/LHp prechiller 
pack 

GHe bank + LH? dewar for 
ground prechill 

Ground based 

LHe carry along 

Auxiliary LHe dewar ground 
or flight 

Complex, unnecessary 

Use orbiter trapped 
residuals 

SSME propellants 

Complex 

IUS/TUG vent gas 

Due to heatup of IUS/TUG 

Comp! ex 

LF 2 vent/dun, p 

From LFg tank 

Very undesirable in 
populated areas 

Refrigeration systems 

Use refrigeration cycle, 
i.e., condense and expand 

Very complex and 
expensive heavy not 
state-of-the-art . 


* 5 centimeters 

** heatup and overpressurization 


<" \ 
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Table 4-8. Comparison of Simplicity and Safety Alternatives 


METHOD 

1. (ON GROUND): 

PRO 

CON 

COMMENTS 

* INSULATION (FOAM) ^ ^ 

PREVENTS ICE LOWERS 
HEAT LEAK 


OBVIOUSLY NEEDED 
USE PB.I FOAM 

# THERMAL INERTIA - F 0 

o. c. 

- 


OK DURING TRANSFER 
OPERATIONS 

& THERMAL INERTIA - GHe 

EASILY AVAILABLE 


SUPPLEMENTS F„ 

^ GHe RELIEF COOLDOWN 

N/A 

LIMITED CAPACITY 

THERMAL INERTIA 

#■ ln 9 pack 

INEXPENSIVE 


GROUND’ EQUIPMENT 

# GHe/LH 2 PACK 

AVOIDS F 2 /H 2 . REACTION 

MORE COMPLEX THAN LNg 

PROVIDES 25° + PRECHILL 

• LHe PACK 

SIMPLER THAN ABOVE 

MORE EXPENSIVE THAN GHe . 


0 USE ORB ITER TRAPPED RESIDUALS 

N/A 

NOT AVAILABLE HERE 

NOT APPROPRIATE THIS PH 

0 I US/TUG VENT GAS 

N/A 

ADDS COMRUBXITY-NOT 
ALWAYS AVAILABLE 

NOT APPROPRIATE 

X LF 2 VENT/DUMP 

SIMPLEST 

TOXIC VENT IS NOXIOUS 
' AND A HAZARD EVEN IF 
BURNED (?) 

UNACCEPTABLE AT KSC 
(CAP UNTIL LAUNCH) .... 


(1) MULTI-LAYER INSULATION NOT SUITABLE FOR PLANETARY TRANSFER 

(2) : WITH HYDROCARBON OR H 2 0 - (O.K. IF REACTED WITH CARBON) # ' PREFERRED 0 NOT AVAILABLE 

(£) IF REQUIRED (o) NOT ALWAYS AVAILABLE 

V H/A HOT AVAILABLE ‘ TECWQUES 


X NOT RECOMMENDED 



SS“fr 



Table 4-8. Comparison of Simplicity and Safety Alternatives (Continued) 


METHOD 

DURING~K5CENT AND 0|j ORBIT 




COMMENTS 


•* INSULATION ( FOAM) ^ ^ 

THERMAL .INERTIA - Fg ' 

* THERMAL INERTIA - GHe 

* GHe RELIEF COOLDOWN 

• LN g PACK 

• GHe/LH 2 PACK ‘ 

• LHa PACK • 

(6) USE ORB ITER TRAPPED RESIDUALS 

• IUS/TUG VENT GAS 

(#)lf 2 VENT/DUMP 
(EX-ATMOSPHERIC) 


OPERATES IN ATMOSPHERE MAY BE UNNESSARY 

ON ORBIT 

SIMPLEST LIMITED DURATION 20 HR. PRECHILL 

6-20 HOURS PROBABLY ACCEPTABLE 

EASILY AVAILABLE CARRY GHe AT LF2 TEMP 

. - LIMITED CAPACITY SMALL EFFECT VENT 

VIA HEAT EXCHANGER 

MODEST WEIGHT CARRY IN SHUTTLE 

PENALTY 

NOT REQUIRED \ " 

- NOT REQUIRED * 

LOW WEIGHT PENALTY ADDS COMPLEXITY -ONLY 100 COMPLEX 

AVAILABLE AFTER STAGING" 

LOW WEIGHT PENALTY ADDS COMPLEXITY 

STRAIGHT FORWARD ORB ITER MODIFICATIONS INCAPACITATES MISSION IF. 

REQUIRED ANY VENTING 


# PREFERRED 0 NOT AVAILABLE 

(•#) IF REQUIRED (o) HOT ALWAYS AVAILABLE 
N/A NOT AVAILABLE # 0THER TECTO^S: 

V NOT RFCnMMI.NnFD 
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Table 4-8. Comparison of Simplicity and Safety Alternatives- (Continued) 


METHOD 

3. (DESCENT) * 

* INSULATION (FOAM^ 1 ^ 

* THERMAL INERTIA - F 2 

* THERMAL INERTIA - GHe ? 

GHe RELIEF COOLDOWN 

* LNj, PACK: 

* GHe/LH 2 PACK 

* LHe PACK 

(O)USE ORB ITER TRAPPED RESIDUALS 

* IUS/TUG VENT GAS 
X LF 2 VENT/DUMP 


* INCLUDING RTLS 


PRO CON ;■ • COMMENTS 

SAME AS SAME AS : ' 

ASCENT ASCENT SAME AS ASCENT PHASE - IF 

DUMPING USED IT SHOULD BE 
COMPLETED BEFORE ATMOSPHERE 
RE ENTRY. ) T ' . 

V ' ■■ V, , ■ ' ■ 


# PREFERRED 0 NOT AVAILABLE 

[%) IF REQUIRED (o) NOT ALWAYS AVAIL ABLE 

ft/A HOT AVAILABLE * 0T1)ER 

X MOT RECOMMENDED 


S3“i? 


Table 4-8. Comparison of Simplicity and Safety Alternatives (Continued) 


METHOD 

{MORTAL LANDING) 

PRO 

CON 

COMMENTS 

* INSULATION (FOAM)^ 

SLOWS AERO HEATING 

. - . ' \ 


* THERMAL INERTIA - F z 

SIMPLEST 

DURATION LIMITED 

SHORT PERIOD 

« THERMAL INERTIA - 6H 2 

- ‘ 

■ - . . ' , . 

SHORT PERIOD 

• GHe RELIEF COOLDOWN ■ • 



SHORT PERIOD 

• ln 2 PACK 

; N/A 

N/A 


• GHe/LH 2 PACK 

N/A 

N/A 

- 

• LHe PACK 

N/A 

N/A 

- 

* USE ORBITER TRAPPED RESIDUALS 

N/A 

N/A 


• IUS/TUG VENT GAS : 

; ; . : . N/A 

N/A 


» lf 2 vent/dump 

DUMP SYSTEM MUST NOT 
OPERATE DURING THIS 
PHASE 

DUMP SYSTEM MUST NOT 
. OPERATE DURING THIS 
PHASE - 

NOT PERMISSIBLE TO 
USE - MUST NOT MAL- 
FUNCTION HERE 



# PREFERRED 

0 NOT AVAILABLE 

'.I;.';- V ■ " ' ' " 


(t ) IF REQUIRED 

(o) NOT ALWAYS AVAIL ABLI. 



N/A NOT AVAILABLE 

• OTHER TECHNIQUES 


• X NOT RECOMMENDED 
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Table 4-8. Comparison of Simplicity and Safety Alternatives (Continued) 


METHOD 

PRO 

; con 

COMMENTS 

fPOST LANDING - BEFORE HOOKUP}- 



- ~ , '■ - .. •' 

* INSULATION . 

SLOWS HEATING 



# THERMAL .INERTIA - F £ 

DELAYS PRESSURE RISE 

.-V- 

. LIMITED DURATION 

* THERMAL INERTIA - 6He 

DELAYS PRESSURE RISE 



* GHe RELIEF COOLDOWN 

DELAYS PRESSURE RISE 



(*) ln 2 PACK 

- 

"Hv 

AIRBORNE ONLY 

^ • GHe/LHg PACK 

N/A 

M/A 


^ • LHe PRECHILLER PACK 

N/A 

N/A 

/ PROBABLY CONSUMED 

(o) USE ORBITER TRAPPED RESIDUALS 

N/A 

N/A ; 

MAY NOT BE AVAILABLE 

Co) IUS/TUG VENT GAS 

M/A 

N/A 

MAY NOT BE AVAILABLE 

i lf 2 vent/dump 

N/A V;- v 

N/A 

: NOT PERMISSIBLE 


PREFERRED 0 HOT AVAILABLE 

(*•) ir REQUIRED (o) HOT mm AVAILABLE 

N/A NOT AVAILABLE ' •* 0THER TECHNIQUES 
V MOT PfCnMHLNOF" 
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Table 4-8 i Comparison of Simplicity and Safety Alternatives (Continued) 

METHOD PRO ' - : :: CON - COMMENTS 

(POST LANDING-AFTER HOOKUP) =' L-V _ , ~ 

• INSULATION (FOAM) ^ -V SLOWS HEATING ‘.K : : 

' PROMOTES COOLING ' 

• THERMAL INERTIA - F 9 . f DELAYS 'PRESSURE : ^ 

'■*- rise ':i-v 

• THERMAL INERTIA - 6He ' " . ■ 

• GHe RELIEF COOLDOWN # 

-#-LN 2 PACK ' MANDATORY T;. 

• GHe/LH 2 PACK (GROUND) (PRE CHILLER) 

• LHe PACK 

• USE ORBITER TRAPPED RESIDUALS . N /A 

t IUS/TUG VENT GAS 

• LFg VENT/DUMP 


PREFERRED 0 HOT AVAILABLE 

(■#.) IF REQUIRED (o) HOT ALWAYS AVAIL ABLf 
N/A. NOT AVAILABLE * OTHER TECHNIQUES 

. v 'inf DrrnHr.in,|nrn 


N VENT/DUMP MUST CONTAIN PROPELLANT 
(THERMAL CONDITIONING PROCEDURE FOR 
PROPELLANT: REMOVAL AT LANDING SITE 
IS MANDATORY - EITHER DETANK OR 
. DEMATE); 
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Table 4-8. 


METHOD 


(CRASH LANDING) 
* INSULATION (FOAM) ^ 


* THERMAL INERTIA - F„ 


# THERMAL INERTIA - GHe 
0 GHe RELIEF COOLDOWN 
'rLN^.fT’ACK:;/^ 
t GHe/LH 2 PACK 

• LHe PACK 

• USE ORBITER TRAPPED RESIDUALS 

• IUS/TUG VENT GAS 
• LF^VENT/DUMP 


Comparison of Simplicity and Safety Alternatives (Continued) 


PRO 


CUSHIONS F 2 TANK 


,LN z DOUSES FLAMES 


LHe DOUSES FLAMES 


LF 2 TANK EMPTY 


COM 


COMMENTS 


ADDITIONAL HARDWARE 


lh 2 is a hazard 


ADDITIONAL HARDWARE 
ADDITIONAL HARDWARE 
ADDITIONAL COMPLEXITY 
COMPLICATES ORBITER 


F„ REMOVAL PROCEDURES NEEDED 


* PREFERRED 
(#) IF REQUIRED 

N/A NOT AVAILABLE 
V; mot RFCOMFrunm 


O HOT AVAILABLE 
(o) HOT ALWAYS AVAILABLE 
* OTHER TECHNIQUES 


iL 



4 * 

.I::" 

cn 
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Comparison of Simplicity and Safety Alternatives (Continued) 


METHOD 

;GR0UND 

HOLD 

ASCENT/ 

OH-ORBIT 

DESCENT 

NORMAL 

LANDING 

POST-LANDING 
BEFORE HOOKUP 

POST-LANDING 
AFTER HOOKUP 

CRASH 

LANDING 

SUMMARY 

COMMENTS : 
OBVIOUSLY NEEDED 

• IHSULATION 


V * 

* 

* 

* 

'■ * ; 

(*) 


• ; THERMAL INERTIA - F g 


* 

* 

* 

* 

A 

* 

*• 

INHERENT 

• THERMAL INERTIA - Glle 

* ; 

* 

* 

a 

* 

ft 

(o) 

* 

EASILY DESIGNED IN 

• GHe RELIEF COOLDOWN ■ 

* 

* ' 

* 

• . 

* 

1 

(o) 

* : 

SMALL EFFECT-EASILY DESIGNED 
IN-USE INCAPACITATES MISSION 

• LfL, PACK 

/:Aff ; ■ 

: m : 

») 

a 


• m 

BS 

* 

GROUND SYSTEM MANDATORY 
FLIGHT SYSTEM DTTTME - 

• GHb/LH 2 pack PRECHILLER 

* :• 

• 

- *, 

• 

• . 

* 

to) 

* 

GROUND SYSTEM ONLY 

• Lite PACK 

• 

a 

a 

■ 

a 

* 

(0) 

B 

NOT REQ'D. - USE U( 2 

•USE ORB ITER TRAPPED RESI- 
DUALS 

• IUS/TUG VENT GAS 

p 

a 

* 

• 

to) 

(o) 

(o) 

ft 

TOO COMPLEX 

p 

(°) 

(0) 

(o) 

(0) 

Co) 

(o) 

to) 

COMPLEX, MAY HOT BE AVAILABLE 

• lf 2 veht/dump 

m 

(*) 

X 

; co 

m 

on 

# 

TBD 

MAY OFF LOAD THROUGH TILL 
AND DRAIN. USE COMPROMISES 


unnin » ujl ivjhjl.juj 

OTHER SYSTEMS-DUHF SYSTEM IS 
A SIGNIFICANT HAZARD IF IT 
MALFUNCTIONS'. 


IZ3 SIGNIFICANT POTENTIAL HAZARD 
•* PREFERRED. METHODS 
(# IF REQUIRED 
• OTHER TECHNIQUES 
X NOT RECOMMENDED 

o HOT AVAILABLE (o) HAY HOT BE AVAILABLE 



In summary: 

t The selected approach is to use insulation and thermal inertias. 

• The regulated system and 4 tank blowdown appears satisfactory for 24 
hours for 320 kb 700 Ibm 

• Larger systems possibly do not need an LN 2 pack, since heatup time 
increases. 

• The LN 2 pack creates some lower order hazards - category 2 or 
less due to possible malfunctions. 

e LF 2 dump system is not needed for thermal considerations, but 
may be needed for safety, due to externally inducted hazards 
to the oxidizer system. 

• The 2 tank blow down system is marginal at 6 hours for 700 Ibm 
of LF 2 and may require a LN 2 carry along for flight or vent/ dump. 



At this writing J PL prefers to use an LN 2 pack carrier in the cargo bay. 
This would be a conservative approach. 



4.3 TASK 4. METHODS OF LEAK DETECTION AND CONTROL 

4.3.1 Task Statement 
The task statement is: 

Determine methods of detecting a failure in the oxidizer 
system and describe the essential equipment and proce- 
dures for coping with credible failures on the ground 
and in shuttle flight for the cases below: 

1) Failures characterized by low leak rates 

2) Massive spills. 

4.3.2 Leak Detection and Control 

Procedures for coping with oxidizer leaks or spills in LF 2 /N 2 H^ 
and NgO^/MMH propulsion systems to be described are based on procedures 
used or determined in the following activities: 

• Rocket and other combustion device testing such as is 

conducted by TRW at its Capistrano Test Site near San 
Juan Capistrano, California (extensive LF 2 and O. 
experience) c 4 

• Liquid fluorine spill testing performed at the Air 
Force Rocket Propulsion Laboratory, Edwards Air Force 
Base, California 

• N 2 O 4 /MMH Leak and spill procedures developed for 

military systems-. , 

In implementation of desired procedures to cope with the effects of 
failures the recommended precedence of procedures is: 

1) Detection of leak 

2) Determine corrective action 
2) Implement personnel safety procedures 
4} Attempt to isolate leak (shut-off flow) and repair 

5) Attempt to transport system to safe location, if 

possible . 

6) Attempt to; quench f i re with sufficient GN 2 



7) Attempt to contain fire with water 

8} Neutralize F 2 with HgO*. Recommended procedures could be 
as described in Reference 1. 

The requirements for safe launch and flight will, of necessity, 
include elaborate and substantial work to preclude leaks and spills; how- 
ever, procedures for coping with such contingencies are necessary at all 
sites where the propellants are stored, transported or (especially) loaded. 

Credible possibility of failures involving leaks or spills will 
exist at least at the loading location during transport and may exist at 
the launch pad. 

It is expected that these leakage hazards will be associated with 
(1) the lines and GSE used to load the propellant in systems other than 
the spacecraft, and (2) those due to accidental damage or mishandling of 
the loaded tank at other locations. Design deficiencies should not be a 
problem because the system will have been carefully checked during 
development, as part of the development and safety plans. 

Methods of leak detection are: 

• Visual by operating personnel 

• Olfactory (smell) by operating personnel 

• Hissing or other noises 

• Change of pressure 

• Thermocouples 

• Indication from corrodible sensor wire 

• Portable vapor detector 

• Sensitized paper 

• Vapor detection monitors 

• TV surveillance 

• Attached leak sensor 

*F,, reacts vigorously with water to form HF and 0^ with release of heat, 

however the reaction is less energetic than that with other fuels. 

An excess of water will reduce the temperature and limit damage if 
delivered in small droplets. 
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Detection of fluorine vapor at rocket test sites Is usually accom- 
plished by odor or by means of a hand pumped detector. More sophisticated 
vapor instrumentation used in the past may have given false indications 
due to other chemicals or insufficient development for the direct 
application. 

Although olfactory and manual techniques together with corrodible 
wires and sensing papers may be combined to form satisfactory emergency 
procedures for early launches, remote sensing techniques, if demonstrated 
practical could after suitable development, result in a more convenient 
and perhaps safer system for subsequent launches. 

Leaks occurring during propellant loading operations in an explo- 
sive safe area may be handled in the same manner as those at a rocket test 
site. This means to repair if possible, remove to a safe location, or 
spray with water to cool and react Fg to less toxic HF. 

Spills should be handled as determined by a program conducted by 
Allied Chemical Co. at the Air Force Rocket Propulsion Laboratory at 
Edwards Air Force Base, California (Reference 13). 

A judgement as to the credibility of a leak of the loaded and 
sealed fluorine tank at the pad has not been made, however, if a leak 
were to occur, the same basic techniques would be used, i.e., repair, 
remove, or extinguish. A leak or spill at the pad would, of course, have 
greater ramifications and procedures would involve more considerations. 

For the amount of fluorine considered, 0-3000 pounds, typically 
700 pounds, procedures are defined which should contain any damage to the 
immediate area of the leak or spill. 

For larger quantities, the problem of toxicity increases 
because of the higher hazard potential inherent in the larger quantity, 
if a spill were to occur. 

4.3.3 Toxicity 

Toxicity is of interest in this study as it is one of the param- 
eters needed to determine the necessary controls. 
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If one can smell fluorine, the concentration may be considered to 
be excessive fGr continuous exposure, and personnel should leave the area 
within a few minutes. It has been found, as could be expected, that venting 
of fluorine in a still atmosphere creates heavy pockets of the gas in areas 
that originally contained no fluorine. Inhalation of a lethal concentration 
of fluorine is considered impossible because its stifling effect is so 
severe that choking and asphyxia would result if relief or escape were 
delayed beyond a few seconds. 

Fluoride dusts are toxic; and, any deposits formed on equipment 
exposed to fluorine should be handled as toxic material. Intake of fluo- 
rine compounds, such as metallic fluorides can cause nose bleeds and sinus 
trouble, loss of weight, back stiffness and spinal chord paralysis. 

Following the ingestion of fluorine or fluorides, reaction of body 
fluids v/ith fluorides releases potent hydrofluoric acid. Whether poison- 
ing is caused b,y the fluorine itself or by the hydrofluoric acid formed 
by the reaction of fluorine with water in the body is a moot question. 

The levels of the maximum allowable toxic gas concentration and 
exposure to dosages defined under the "Clean Air Act," Public Law 88-206, 
Reference 16, are to be considered in defining the specific hazard poten- 
tial of the site for fluorine and fluorine compounds. The legal values 
are based on the Threshold Limit values, which were applicable prior to 
1972 and which were established by the American Conference of Govern- 
mental Industrial Hygienists (and cited in Reference 1). These values 
were 0.1 ppm for fluorine and 3 ppm for hydrogen fluoride. These values 
were recommended as a guide in the control of health hazards and repre- 
sent conditions to which nearly all workers may be exposed, day after 
day, without adverse effect. The values are for time-weighted average 
concentrations for a normal work day. After passage of the law and 
incorporation of the 0,1 ppm value, the ACIGH changed this value to 1.0, 

The amount by which these figures may be exceeded for short 
periods without injury to health depends upon a number of factors, such 
as: the nature of the contaminant; whether very high concentrations, 
even for short periods, produce acute poisoning; whether the effects are 
cumulative; the frequency with which high concentrations occur; and the 
duration of such periods. 


■^Occupational Safety and Health Act. 
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Table 4-10. Toxicity 




ft 

HF 

N 2°4 

NO^ 

NO 

1 . 

Threshold Limit Value^, 
(TLV), ppm 

0.1 

3 

2.5 

5 

25 

2. 

KSC SPG0 Handbook^ 



2.5 



3. 

OSHA^ critical valufe 

0.1 


2.5* 

2.5 


4. 

ACGIH EEL 10 minute, ppm 

15 

20 

(converts 

30 



Vall . pts (l) 30 minute, ppm 
va,ues 60 minute, ppm 

10 

5 

10 

8 

to N0 2 ) 

20 

10 


^American Conference of Governmental 

Industrial 

Hygienists, 

1972 



^Shuttle Payload Grouni Operations Safety Handbook-Draft, 14 Oct 1974 
(Prepared for NASA KSC by TRW, FLorida Operations) 

(^Occupational Safety and Health Administration, OSHA 

(^CPIA PUB No, 194, Rocket/P ropell ant Chemical Hazards, Vol. 3, May 1970 

*N 2 0 4 dissociates to N0 2 in the atmosphere. 

Due to the occasional use of LF 2 anticipated on this program, the 
OSHA critical value is probably not the main concern since the processing 
selected will not cause continuous exposure of personnel at ,\5C to low 
concentrations of vapors, either LF 2 or N 2 0.. This value will, of course, 
be very important at the site ofhardware development. 

Due to vaporization and dispersion, the concentration versus 
time from any leak or spill first increases,. then peaks and decreases at 
any given location. Emergency Exposure Limits (EEL) limit the safe expo- 
sure of personnel to, for example 15 parts per million (ppm) F g for 10 min- 
utes whereas only 0.1 ppm is considered the safe Threshold Limit Value 
(TLV) for an 8-hour day. 

4.3.4 Spill Tests 

In the testing at AFRPL described in Reference 14 with 1070 pounds 
of LF 2 a maximum of 56 ppm was occasioned at a distance of 500 feet down 
wind with the wind at 10 to 15 knots. Boil off from the spill lasted approx- 
imately 4 minutes. Concentration versus time was not reported; however, 
peak concentration undoubtedly did not last for the entire 4 minutes. 

Figure 4-10 shows the distribution of fluorine on this test. 
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Figure 4-10. 1000 Pound Liquid Fluorine Spill Test Without Neutralization 

(Desert Environment) 




This data probably represents the approximate condition for a 
X000 pound unneutralized spill and is much more severe than a test with 
340 pounds of F 2 in which the concentration at 500 feet was measured at 
0-10 parts per million. Although the technique used may have erred on 
the low side in concentrations, especially for the lower concentrations, it 
also counted HF as Fg. Use of the data could be quite conservative, since 
allowables for HF are greater than those for Fg. Thus the primary hazard 
is from unreacted Fg. 

The humidity at KSC is a factor which could help reduce the prob- 
lem by reaction of airborne moisture with Fg. 

Deliberate exposure of personnel to 25 ppm resulted in sore throats 
and minor chest pains for a period of 6 hours and no further after effects 
were noted. 

In a test with a 1605-pound spill neutralized with water, the tank 
was ruptured and water spray turned on 3 seconds later. Fg dissipation 
required 2 minutes 30 seconds. White laboratory rats located 150 feet 
from the spill suffered no ill effects from the test. 

From this data it is estimated that perhaps on the order 1000 to 
2000 feet is a suitable distance for unprotected operating personnel to be 
removed from the site of a potential 1000 to 3000 pound LFg spill. The 
distance might be reduced to somewhat less for NgO^, although a common 
location might be more economical and efficient. 

It is recommended that control equipment trailers be located aw^y 
from the building during propellant loading operations. This will neces- 
sitate some rather long electrical cables. 

It is understood that this is much more conservative than current 
spacecraft practice or practice at rocket test sites; however, it is in 
keeping with practices on Titan booster launches wherein all personnel 
move back to the Vertical Integration Building for the launch. 

4.3.5 Propellant Vapor Detection — Current Rocket Practice 

Fluorine and hydrofluoric acid are both very toxic substances which 
are detectable by odor. 
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Detection techniques in current practice are summarized in 
Table 4-11. The human nose is one of the best and most sensitive detectors 
of fluorine. Tests at Lewis Research Center indicate that the threshold 
concentration for detection by smell is 1 ppm or lower. Some claims have 
been made that quantities as low as a few parts per billion (possibly 3-17) 
might be the minimum concentration detectable by odor. 

Reference 3 concludes: "Although the objective methods of detec- 

tion possess considerable merit and one form or another seems to justify 
a place at every bulk fluorine facility, the subjective method of detec- 
tion (with one's nose) is still the most reliable method of detection of 
small quantities of fluorine." 

This provides a measure of protection by signaling a potentially 
hazardous situation. However, excessive or prolonged exposure deadens 
sensitivity or damages tissues so that reliable instrumentation is desire- 
able for safety. Also, area monitoring is desireable to sense leaks or 
malfunctions in remote areas when no one is nearby. 

For the detection and location of small gas leaks, ammonia in 
plastic squirt bottles can be used as a rapid qualitative test. If fluo- 
rine is present, the reaction produces a white smoke which is easily visi- 
ble. This test must be performed with caution, however, since a larger 
leak may produce a flame jet. 

Potassium iodide paper provides another rapid detection method. 

This paper will react by discoloration on exposure to fluorine concentra- 
tions as low as 25 ppm. 

Potassium iodide paper turns to a shade of red in the presence of 
Fg. There are also other available paints and papers and solutions which 
change color in the presence of strong oxidizing agents, fluorides or 
halogens. Mine Safety Appliances, Harrold and Kitagawa offer piston oper- 
ated instruments based on these principles. Such portable, handpumped 
instruments are used during Titan (NgO^/A-50) topping operations, in 
Minuteman silos (NgO^/MMH) and at rocket test facilities (including F 2 use). 
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Table 4-11. Summary and Evaluation of LFp Propellant Vapor Detection Techniques 
(Not A Ranking) 


Method 

• Visual 

• Olfactory 
9 Audible 

® Change of Pressure 

9 Change of Temperature 

9 Corrodable Wire Sensor 
(Fleak Detector) 

9 Portable Detectors 

9 Sensitized Paper 

9 Electro Chemical Monitors 


9 Attached Leak Sensor 
Flight Hardware 


Experience 

Rocket Test 
Rocket Test 
Rocket Test 
Limited 
Limited 
Litni ted 

Rocket Test, other 
Extensive 

Commercial systems available may 
be easily "spoofed" by other 
oxidizers or have other problems 


Appl i cabi 1 i ty 
Yes 
Yes 
Yes 

Should be used 
Should be used 
Where applicable 

During flight 
TBD 

Requi res further i nvesti gati on 
involves many complications 


Pressure and temp easily measured— Desirable, costly 
leakage may be indicated by one of 
several methods, e.g., chemical 
reaction with corrodable wire. 


9 Optical Methods 


Optical Methods in Cargo Bay 


If available 


Leak-indicating paints that undergo vivid color changes when 
exposed to halogens, have been investigated and may be applicable. How- 
ever, their reported low sensitivity to vapor exposure and thei r weather- 
ing characteristics indicated additional development would be required. 

Systems using fluorine oxidizers may have wire detectors wrapped 
on sensitive areas such as joints and gaskets. Leaks or impingemen" of 
the oxidizer burns the wire which causes a signal to shut off the oxidant 
flow at the source, thus limiting damage. 

Paper tape wrapped at selected locations may be used to indicate 
leakage of lesser amounts by exhibiting a burned, discolored or deterio- 
rated appearance. 

TV coverage during transfer operations is an aid in detecting 
gross leaks quickly and cannot be overlooked in any method of instrumenta- 
tion. This system requires continual attention from an observer to be 
useful, but is a useful adjunct to launch site caution and warning systems. 

By combining automated oxidizer sensors with human detection 
capabilities a functional system can be formed, even without the use of 
a specialized ?, instrumentation system. 

It may be advisable, however, to have a hazard warning system for 
fluorine leaks to supplement these techniques before fluorine launch oper- 
ations are implemented. To meet the demands of fluorine operations the 
hazard warning system should ideally be capable of detecting relatively 
small concentrations of fluorine and/or hydrogen fluoride. It would meet 
the following requirements: 

• It should only be sensitive to fluorine and/or hydrogen 
fluoride. It should not give false warnings due to 
detection of other substances. 

• It should be capable of detecting concentrations of 
fluorine and hydrogen fluoride of less then 1.0 ppm. 

• It should give an accurate indication of the fluorine 
concentration continuously. One exposure should not 
desensitize the detector for more than a few seconds. 

• It must be reliable and require only a minimum of 
maintenance. 
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Some instruments are available, however, none appear to be in 
common use for rocket testing for various reasons, listed below. 

Mine Safety Appliance Billion-Aire . This instrument consists of 
a radioactive source which ionizes a stream of air from the sampled envi- 
ronment. A steady ion current is produced unless a contaminant is present. 
Contaminants react with reagents to form aerosols which change the ion 
current. The change in ion current is a measure of the concentration of 
contaminant. This instrument is sensitive to materials which affect the 
ion mobility or quantity. This instrument is large, bulky, and not 
portable. 

Tracer! ab Fluorine Indicator- Recorder . This instrument uses a 
sensing element of krypton-85 quinol clathrate. Exposure to fluorine 
releases krypton-85 which is measured with a radioactivity counter. It 
is also sensitive to moisture and other materials, however, compensating 
adjustments may be made (Model FM-2, Laboratory for Electronics, Inc., 
Waltham, Mass.). 

Teledyne Recorder . This instrument operates as a fuel cell. A 
steady state current flows until the presence of oxidant perturbs the 
equilibrium of a bridge circuit and signals leaks. Humidity affects this 
instrument (Model 5100). Significant maintenance may be required, 

Davis HF Indicator-Recorder . This instrument measures the conduc- 
tivity of a stream of water through which the atmosphere is bubbled. It 
is therefore sensitive to all environmental contaminants wnicn form con- 
ducting ions in solution. (Model 11-701G-RP Special, Davis Emergency 
Equip. Co., Newark, N. J.). 

Thomas Fluorescent and ADAK Colorimeter Instruments . These instru- 
ments have been used but are heavy, bulky and not too sensitive. 

M.S.A. Pump Kits for Sampling Atmospheres . The number of strokes 
on the instrument required to change the color of a sensitive reagent is 
used to measure contaminant concentration, and is affected by many inter- 
fering substances which may change the color of the sensor material. This 
unit has been used after rocket tests to determine if an area is safe to 
re-enter. 
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Convair Fluorine and Fluoride Dosimeter . This instrument measures 
total integrated fluoride and is not adapted to continuous real time 
monitoring (Model 00509). 

Convair Electrochemical Molecular Fluorine Indicator- Recorder . 

During work in connection with FLOXf a fluorine detector was developed 
that is capable of detecting concentrations in the ppm range. It is 
based on the principle of displacement of chlorine ion by fluorine bubbled 
through a lithium chloride solution. A silver wire immersed in the solu- 
tion forms a silver-silver chloride half cell and a platinum electrode in 
the same solution forms another half cell. The voltage generated between 
the platinum electrode and silver wire is nulled out by a mercury cell. 
Fluorine passing through the cell displaces chlorine from the solution. 

The chlorine undergoes oxidation-reduction with a transfer of one electron 
per each atom of fluorine so that the fluorine is measured quantitatively. 
Hence the current is proportional to the amount of fluorine present. 

One ppm of fluorine in a flow of 100 ml per minute through the cell gener- 
ates 1.4 microamps. 

This current is easily measured so that the instrument is specific 
and selective because only fluorine oxidizers (and perhaps ozone) give this 
reaction (Model 00510). 

This instrument works well, except that prolonged idleness caused 
polarization of the electrodes so that they must be reactivated. The pumps 
also require periodic lubrication, but diaphragm pumps might alleviate this 
problem. Also, the lithium chloride solution gradually evaporates so that 
additional solution is required. It is not commercially available. 

Optical detectors operating in the infrared region may be used for 
detecting small concentrations of gases in the atmosphere. These cannot 
be used for directly detecting fluorine as fluorine is nonpolar. They can be 
used as an indirect detector of fluorine, since fluorine reacts with 
atmospheric moisture to form hydrogen fluoride which is detectable by 
infrared techniques. 


*A mixture of liquid fluorine and liquid oxygen. 
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Infrared detection employs nondispersive optical correlation instru- 
ments in which the apparatus is designed to selectively transmit the spec- 
trum of the desired gas, which is placed in a gas cell. The characteristic 
gas radiation is compared with radiation through a similar clean cell in 
the optical path. 

An optical correlation instrument was developed by Convair under 
AFRPL Contract F04611-70-C-0Q64, ’'Development of HCL and HF Detection 
System." The goal of this program was threshold sensitivity of 0.01 ppm. 
However, maximum sensitivity was to 0.1 ppm. The results of this program 
indicated a more sensitive instrument could be developed by using a longer 
optical path, a more intense source, and/or a better detector. 

Several other types of fluorine detectors have been tested or pro- 
posed (see Reference 4). The techniques suggested for detection include 
mass spectrometry, ionizations, lasers, and electro-conductivity. None 
of the proposed systems is considered completely satisfactory and most 
require development. 

4.3.6 Organization and Personnel Factors and Procedures 
4. 3. 6.1 Ground Crew 

There are many aspects of human or personnel considerations. The 
goal is to properly deploy the system and send it on its mission. In order 
to accomplish this goal, it must be loaded, transported, installed and 
boosted into orbit and deployed. At each of these steps there are some 
potential hazards which might allow escape of oxidizer. While it is 
believed that these hazards may be controlled and that they tend to 
decrease as the system moves toward deployment, an organization is required 
which can: 

• Conduct efficiently normal operations. 

« Conduct efficiently abnormal operations and preclude 
acci dents . 

• Repair or work around difficulties. 

• Properly "safe" the system in event of malfunction or 
damage. 

• If necessary, perform operations to minimize damage. 


Some of the personnel considerations that must be considered are 
shown in Table 4-12. It is believed that in order to properly and safely 
conduct these operations with a loaded spacecraft propulsion system and the 
very valuable facilities (PCF) involved, that the NASA will wish to have a 
24-hour watch crew at-the-ready from the time that the system arrives at the 
pad until launch. This is a period on the timeline from approximately 
130 hours to liftoff which could occur at 170 to 180 hours. Fifty hours 
on the timeline could be approximately 6 days so provisions would be needed 
for three crews for that period of time. They might consist of: 


Cognizant Engi neer 

M. 

I 

Shift 

Swing 

Night 

Asst. Cognizant Engineer 

1 

1 

1 

Mechanical Leadman 

1 

1 

1 

Electrical Leadman 

I 

1 

1 

Propellant Safety Qualified 
Technicians 

3 . 

3 

3 

Electronics Technician 

1 

1 

1 


All these personnel should be well versed in propellant safety and 
checked out on the systems. They may have other normal functions and only 
be activated for these types of launches.’ The cognizant engineer should be 
whomever has primary responsibility for the safety of the PCF and Orbiter. 
Members of this crew may be the same personnel who will be responsible 
for loading NgO^/MMH into the shuttle or racket test personnel on temporary 
assignment. 

A training program for these personnel appears appropriate to both 
create familiarity with both the equipment, and procedures for coping with 
credible failures on the ground. Specific recommendations are summarized 
in Tables 4-13 through 4-15 which consider leaks and spills general and 
specific leaks and spills. 
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Table 4-12. Personnel Considerations - Precautionary Procedures 

Precautions for When Tankage not in Explosive Safe Storage 


• TRASHING IS KEY TO PROPER RESPONSES 

• PERSONNEL MUST BE FORMALLY TRAINED IN F„ HANDLING AND SAFETY, AS WELL AS 
FOR N 2 G 4 . 

• PERSONNEL SHOULD BE CERTIFIED TO CARRY OUT LF^ OPERATIONS. 

• PERSONNEL FORM PART OF DETECTION SYSTEM (WHEN WORKING ON NEARBY SYSTEMS). 

• TIME ELEMENT CRITICAL — RECOMMENDED A WELL-THOUGHT-OUT APPROACH 

• 24 HR. RESPONSE CAPABILITY REQUIRED TO REPAIR OR REMOVE. 

• FIRE EQUIPMENT AT THE READY, WITHIN SIGHT OF SYSTEM - WITH F„ PROTECTED 

EQUIPMENT. £ 

• LOADING AND HANDLING PROCEDURES FORMALIZED AND PERFORMED BY USING A CHECKOFF 
LIST. THE CREW SHOULD PRACTICE WITH LN 2 . 

• ALL UNNECESSARY PERSONNEL EXCLUDED, 
t ALL OTHERS INSTRUCTED IN EVACUATION. 

• EQUIPMENT SHOULD BE FOOL-PROOF AND EASY TO HANDLE; NO TWO ERRORS TO 
CAUSE A CATEGORY 1 HAZARD. 

• EVACUATION AND REGROUPING PLANNED. 

• SOFTWARE MUST BE PROVEN SAFE . 

• ALL ALTERNATE BACKQUT OPERATIONS MUST BE SAFE 

• F 9 COGNIZANT ENGINEER MUST BE CALM AND AVOID UNNECESSARY RADICAL RESPONSES 
WHICH COULD DAMAGE SYSTEM —24 HR. COVERAGE. — ROCKET TEST CONDUCTOR 
EXPERIENCE, WITH PREVIOUS EXPERIENCE WITH LF^. 

• PERSONNEL WORKING IN SCAPE SUITS SHOULD IDEALLY HAVE RF COMMUNICATIONS NOT 
TELEPHONE. 
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Table 4-13. Considerations ana Recommendations 
Leaks and Spills General 


1. A PERSON SHOULD BE ASSIGNED OVERALL RESPONSIBILITY FOR 'SAFETY OF THE FLUORINE 
SYSTEM WITH AUTHORITY TO INITIATE SAFETY PROCEDURES. COVERAGE SHOULD BE PROVIDED 
WHENEVER THE SYSTEM IS NOT SECURED IN A SAFE STORAGE LOCATION. THIS PERSON CAN 
HAVE OTHER RESPONSIBILITIES. 

2. CONTINUOUS MONITORING OF FLUORINE STATUS PRESSURE, TEMPERATURE AND VAPOR DETECTION 
IS RECOMMENDED. THIS MAY REQUIRE 24 HOUR COVERAGE INCLUDING MEAL TIMES. 

\ 3. SIMILARLY A TRAINED PROPELLANT SAFETY TEAM READY TO RESPOND IMMEDIATELY IS REQUIRED. THEY 
\ ALSO MAY HAVE OTHER TASKS TO PERFORM UNDER NORMAL CONDITIONS. (IT MAY BE NECESSARY 

\ FOR EXAMPLE TO PROVIDE MEALS SO THAT PERSONNEL WILL BE AT THEIR EMERGENCY STATIONS) 

\ 

'4. ALL PERSONNEL SHOULD BE TRAINED TO RECOGNIZE FLUORINE BY ITS COLOR AND ODOR AND BE 
\ ABLE TO REPORT CONCENTRATIONS IN STANDARD TERMS,* E.G., SLIGHT, MODERATE, STRONG, 

V SEVERE AND INTOLERABLE. 

s\ SAFETY PROCEDURES SHOULD INCLUDE: 

• DETECTION AND REPORTING BY HUMANS 

• AUTOMATIC DETECTION 

t DETERMINATION OF HAZARD 

i RESPONSE TO HAZARD LEVEL, E.G., TURN ON FAN & EVACUATE AREA, 

DUMP PROPELLANT OR, INITIATE LOW WATER FOG, EVACUATE, INCREASE 
WATER FLOW. 

*WHICH HAVE THE SAME MEANING TO ALL PERSONNEL. 
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Table 4-13. Considerations and Recommendations Leaks and Spills General (Continued) 

6. ALL LEAKS WILL NOT REQUIRE EXTREME EMERGENCY PROCEDURES. 

7. AN INDOCTRINATION SESSION FOR THE PROPELLANT SAFETY TEAM SHOULD BE HELD PRIOR 
TO EACH OCCASION OF USE OF LFg. 

8. A SIGN-IN SHEET ACKNOWLEDGING RECEIPT OF SAFETY EVACUATION INSTRUCTIONS SHOULD 
BE ESTABLISHED FOR ALL PERSONNEL WHO WILL BE IN THE PAD AREA DURING LFg HOLDING 
IN THE ORBITER. 

g, SAFETY EVAUCATION INSTRUCTIONS FOR PERSONNEL OTHER THAN PROPELLANT SAFETY TEAM 
SHOULD DESCRIBE HOW TO EVACUATE THE AREA IN EVENT OF A LEAK OR SPILL AND WHERE 
TO GO FOR FURTHER INSTRUCTIONS s E.G., REASSEMBLE IN LOBBY OF MISSION CONTROL BLDG. 

10. CONTINGENCY PLANS FOR RECOVERY OF ORBITER TIMELINE SHOULD BE PREPARED. 

11. AUTOMOBILE PARKING SHOULD BE ARRANGED SO THAT TRANSPORT IS AVAILABLE FROM TWO 
SIDES OF THE PAD SO THAT EVACUATION IS POSSIBLE INDEPENDENT OF PREVAILING WIND. 

12. FIRE TRUCKS SHOULD BE KEPT AT THE READY AND SHOULD CONVOY WELL BEHIND THE SYSTEM 
WHEN IT IS BEING MOVED. FIREMEN SHOULD HAVE SCAPE SUITS AND PARTICIPATE IN PROPEL- 
LANT SAFETY TEAM TRAINING. 


Table 4-13. Considerations and Recommendations Leaks and Spills General (Continued) 


13. RECOGNITION SHOULD BE GIVEN THAT UNUSUAL CARE SHOULD BE TAKEN TO 
AVOID DAMAGE TO THE ARBITER FROM LEAK AND SPILL PROCEDURES. 


14. ON DISCOVERY OF A FLUORINE EMERGENCY, AN ANNOUNCEMENT SHOULD BE 
MADE ON THE PUBLIC ADDRESS SYSTEM OR OTHER COMMUNICATIONS 
SYSTEM AND ALSO AT THE FIRE STATION AND SECURITY OFFICE. 


15. TRAINING SHOULD ALSO BE GIVEN TO SECURITY PERSONNEL AS REGARDS 
EVACUATION AND TRANSPORTATION. 


16. PUBLIC ACCESS TO AREAS WHERE FLUORINE IS KEPT OR LOADED SHALL 
BE FORBIDDEN. 
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Table 4-14. Considerations and Recommendations - Leaks 


1. GROSS LEAKS MAY NEED TO BE TREATED LIKE SPILLS. (SEE NEXT PAGE) 

2. * LEAKS ARE MOST LIKELY FROM THE GSE CONNECTIONS AT THE LOADING SITE. 

• LEAKS ARE NEXT MOST LIKELY FROM THE GSE DURING TRANSFER OPERATIONS. 

• LEAKS ARE LEAST LIKELY FROM THE PROPULSION SYSTEM ESPECIALLY AFTER TRANSFER IS 
COMPLETE - UNLESS IT RECEIVES GROSS DAMAGE. 

FOR THESE REASONS: 

* LOADING SHOULD BE DONE AT AN EXPLOSIVE SAFE FACILITY 

• THE LFg TANK SHOULD BE PROTECTED FROM DAMAGE 

3. SMALL LEAKS FROM LINES DURING ISOLATED FILLING OPERATIONS MAY BE STOPPED BY STOPPING 
FILLING OPERATIONS AND ASPIRATING THE LINES. 

4. SMALL LEAKS FROM GSE MAY BE SIMILARLY HANDLED EXCEPT TANK LEAKS, WHICH REOUIRES DISPOSAL 
OF TANKED PROPELLANT 

5. IF THE SOURCE CANNOT BE ISOLATED OR TRANSPORTED, AS A LEAKING TANK*, THE 
SYSTEM SHOULD BE ALLOWED TO VENT OFF AS SLOWLY AS POSSIBLE THROUGH A CHIMNEY OR 
ASPIRATION DEVICE. (UNNECESSARY PERSONNEL SHOULD BE EVACUATED) 


*SOME LEAKING TANK SHUTOFF VALVES CAN BE REPLACED BY PERSONNEL IN SCAPE UNITS. 
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Table 4-14. Consideration and Recommendations - Leaks (Continued) 


6. IF IGNITION HAS TAKEN PLACE, IT MAY BE POSSIBLE THAT IT CAN BE SUFFOCATED BY Ng. 
HOWEVER, UNDER SOME INSTANCES, THIS IS AVAILABLE AND CAN BE TRIED BEFORE WATER. 

(IF THE FIRE IS SMALL) 

7. IF IGNITION STOPS, THE WATER CAN BE TURNED OFF PENDING DETERMINATION OF LEAK RATE. 

8. IF IGNITION HAS TAKEN PLACE AND INVOLVES MORE THAN A SMALL AREA, PERSONNEL PROTECTION 
WATER FOG SHOULD BE INITIATED AND THE ARE EVACUATED EXCEPT FOR NECESSARY 


PERSONNEL. 
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Table 4-16. Considerations and Recommendations - Spills 


1. THE RECOMMENDED DECONTAMINANT FOR LIQUID FLUORINE SPILLS IS WATER FOG AND WATER FOG COUPLED WITH 
A SETTLING TANK FOR LARGE BUNKER SPILLS. REFERENCE 13. 

2. PERSONNEL MUST BE TRAINED IN FLUORINE HANDLING PROCEDURES AND PROCEDURES FOR FIRE SUPPRESSION. 

3. FLUORINE-FLUORIDE DETECTORS ("SNIFFERS 11 ) SHOULD BE INCORPORATED INTO A FACILITY. THESE 
DETECTORS SHOULD OPERATE AUTOMATICALLY SO THAT A SPILL WILL SIMULTANEOUSLY SOUND AN ALARM, TURN OFF 
FLUORINE VALVES, AND ARM THE NEUTRALIZATION SYSTEMS. 2 OUT OF 3 DETECTORS ACTUATE AUTOMATIC DELUGE. 

4. ALL PERSONNEL WORKING WITH FLUORINE SHOULD HAVE PRE- EMPLOYMENT PHYSICALS AND REGULAR PHYSICAL 
EXAMINATIONS TO DETERMINE IF THEY ARE ASSIMILATING FLUORINE; MEDICAL ASSISTANCE SHOULD BE AVAILABLE 
IMMEDIATELY IN CASE OF ACCIDENT. PERSONNEL MUST BE CERTIFIED YEARLY BY KSC. 

5. ROUTINE ANALYSIS OF FLORA, SOIL AND WATER IN THE AREA WILL GIVE DATA ON ANY BUILDUP OF FLUORIDES SO 

THAT NEUTRALIZATION METHODS MAY BE OBSERVED AND MODIFIED IF NEED IS INDICATED IF MORE THAN 
OCCASIONAL USE OF FLUORINE IS ANTICIPATED. 

6. FUSIBLE LINKS SHOULD BE CONSIDERED FOR THE SERVICING SYSTEM. IN THE EVENT OF SPONTANEOUS FIRE IN 
THE MANIFOLD, THE FUSIBLE LINKS WOULD MELT OUT AND SAVE THE MAIN STORAGE BUNKER AND VALVES. 

7. THE VOLUME OF LIQUID FLUORINE STORED AT ANY LOCATION SHOULD BE KEPT TO A MINIMUM FOR OVERALL SAFETY. 

8. A WEATHER SUB-STATION WORKING IN COOPERATION WITH THE MAIN BASE SHOULD BE A PART OF THE FACILITY TO 

GIVE DATA AND ADVICE ON LOCAL WINDS FOR PROPELLANT LOADING OPERATIONS WHICH IDEALLY SHOULD BE DONE 

WITH FAVORABLE WINDS. 

9. ADDITIONAL WORK SHOULD BE CONDUCTED ON THE DESIGN OF SUITABLE WATER SPRAY INCLUDING GEOMETRY OF THE 
SPRAY PATTERN AND THE DROPLET-SIZE OF THE WATER SPRAY TO EFFECT THE GREATEST EFFICIENCY. 

10. ALL PROCEDURES SHALL BE WRITTEN, PRE-APPROVED, AND CHECKED OFF AS THEY ARE COMPLETED 
IN THE COUNTDOWN. 
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4.3.6. 2 Flight Crew 

Similarly, the flight crew should be prepared for emergencies in 
flight. As described elsewhere, propellant status monitoring is 
suggested. 

Duties of the flight crew will be to: 

• Monitor propellant status 

• Take note of caution signals 

• Take action on warning signal 

• Override automatic dump sequence (if needed) 

• Provide safing commands 

• Dump helium bottles if appropriate. 

4.3.7 Essential Equipment 

Essential equipment is summarized in Table 4-15. The listing of 
trained personnel under the equipment heading is^to emphasize that well 
trained, aware personnel are the key to successful operations. Although 
it can be expected that flight operations with these propellants will be 
much more routine than, for example, rocket test operations, the ability 
to respond properly in case of accident is of prime importance. This will 
be discussed in more detail below. 

Repair equipment and spares are an important aspect of operations 
since continued abnormal operations may add to the hazards. The most 
likely equipment to encounter difficulties is expected to be the loading 
GSE even though considerable effort may have been spent to "de bug" it. 

The development cycle is the same as the propulsion system but typically 
GSE hardware does not see use until after the propulsion system is nearly 
developed. 

Protective suits with self-contained breathing apparatus are needed 
if operations are to be performed on an open or leaking propellant con- 
tainer. These are required for the propellant safety team who would repair 
the system and for any firemen expected to work close to the propellant 
tanks. It may be advisable to have only fluorine compatible suits available 
because in an emergency, personnel might make use of whatever equipment 
is available. 
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Table 4-15. Essential Equipment 


• TRAINED PERSONNEL 

t REPAIR EQUIPMENT/SPARES FOR LOADING GSE** AND LINES 

• F 2 SCAPE SUITS (WITH RF COMMUNICATIONS IF POSSIBLE) PROPELLANT SAFETY TEAM 
AND FIREMEN*** 

• SPARE LN 2 COOLING EQUIPMENT OR CAPACITY 

• LN 2 PURGE (OPTIONAL) 

• PROPELLANT OFF LOAD DEWAR/ F2 RECYCLE SYSTEM, (OPTIONAL) OR 

• F 2 EMERGENCY ASPIRATION/BURNOFF STACK OR CHARCOAL BURNER (OPTIONAL) (ESA AND PAD) 

• TWO LEVEL WATER FOG FIRE SUPPRESSION 

« FIRE HOSES 

• F 2 CAPABLE PROPELLANT SAFETY CONSOLE (COMBINE WITH NgO^/MMH CAPABILITY) 

• COLOR SURVEILLANCE T.V. 

o PROPELLANT VAPOR DETECTION INSTRUMENTS - HAND HELD 

• AUTOMATIC AIR SAMPLING AND VAPOR DETECTION SYSTEM 


LEGEND: *F 2 PECULIAR EQUIPMENT 
**ALSO CALLED OSE OR AGE 

***IDEAL TO HAVE ONLY F 2 SUITS AVAILABLE WHICH ARE ALSO 
SUITABLE FOR OTHER PURPOSES 


Spare LNg cooling equipment or capacity is needed in case of mal- 
function of the cooling systems. 

Ability to chill, quench and decontaminate (purge) the oxidizer 
tank area with liquid nitrogen in an emergency would be desireable but may 
not be practical. This is considered an optional accessory which should 
be investigated. 

Another desirable optional accessory for use at the PCF would be 
an off-load dewar and fluorine recycle system for use at the PCF. This 
could use a transport truck but would require lines at the PCF. It is not 
considered a very practical approach for fluorine as it involves an oxidizer 
line and would be expensive and does not result in a very safe off-load of 
propellant. It is considered better to remove even a leaking propellant 
tank from the area. A connection to the tank would be required and it 
would need to be passivated before further operations occurred. Similarly, 
an aspirator/burnoff stack or charcoal burner requires an oxidizer line, 
and passivation procedure. These two items could be used but the KSC 
Safety Office favors a closed up system without dump capabilities. Articu- 
lation of the line during PCF motion would be another complication. 

A remotely controlled two level water fog fire suppression system 
located in the PCF is essential in case of fire. This appears true regard- 
less of the origin of the fire. Two levels are to provide one level to 
protect personnel who might be in the area and a second level for all out 
control . 

This system may be sized for IUS/TUG requirements, and would be 
adequate for the spacecraft propulsion. If the tug is not loaded until 
after PCF roll back, then it should be sized to handle up to 3000 pounds 
of LF 2 or NgO^. 

Fire hoses should be provided to handle small fires not originating 
in the oxidizer system. Well worked out procedures are required. 

A safety console is desireable at a location remote from the PCF, 
perhaps in the VAB for monitoring propellant status and vapor detection. 
Propellant specific vapor detectors are desired to differentiate vapors, 
but are not absolutely essential. They will be discussed in the next 
section. 
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Color TV surveillance should be maintained on the propulsion sys- 
tems. Color is needed to be able to differentiate between a BFRC and a 
BFGC (Big foggy red or green cloud) representing NgO^ or Fg, respectively, 
so as to know which system is leaking. Hand-held vapor detection instru- 
ments will also be useful. 

An automatic air sampling and vapor detection system is desirable 
which incorporates propellant specific vapor detectors in the PCF. r 

4.3.8 Cone! us ions 

The conclusions of this task are: 

1) Direct human odor sensing of fluorine is the most state 
of the art method. 

2) Combined use of the other methods appears prudent. 

3) Personnel must be highly trained to avoid over response 
or response to false alarms caused by other oxidizers 
and halogen sources. 

4) An evaluation program for fluorine detectors is 
desirable. 

5) Flight caution and warning system will be described 
in Task 8. 
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4.4 TASK 5 N 2 0 4 VERSUS LFg PROPULSION SYSTEMS COMPARISON 

4.4.1 Task Description 

The task statement is: 

Assess the schematics of the propulsion systems shown in 
Figures 1-4 through 1-6. Clearly identify modifications, 
if any, that you recommend for LF 2 use in the shuttle- 
launched spacecraft. Compare LF 2 and N 2 O 4 to determine 
the differences, if any, in propulsion system design. 

4.4.2 System Modifications 

For purposes of this safety study, the comparison of the propulsion 
systems shown previously in Figures 1-4 through 1-6 can be mainly confined 

to the components which contact or might contact fluorine. This includes 
primarily the oxidizer tanks and isolation valves. In addition, the other 
system lines and valves, e.g., the engine valve and the helium isolation 
valve, can be considered as a redundant leakage containment system. 

The system used should be fail -fail -safe or tolerate two failures. 

The system shown has been considered from the standpoint of safety con- 
sidering the design philosophy presented in Appendix 1 , and that before 
flight the system will have been through flight qualification program, 
safety reviews and a safety development program. 

The modifications to the schematics described below are recommended 
for further JPL consideration. 

The configuration shown in Figure 4-11, the externally regulated sys- 
tem or equivalent*, is recommended as safer than that of Figure 4-12, provided 
that an isolation valve is added at the pressurization line inlet at the top 
of the tank. This system is recommended because (1) it can normally be 
handled in the unpressurized mode (see the comparison in Table 4-16), 

(2) it has maximum storage life without cooling. All components in the 
helium system from the latching solenoid down must be fluorine compatible 
because they are redundant propellant containment devices, and must be 
passivated. 


* 


4 Tank. Blowdown 
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Figure 4-11. F 2 /N 2 H 4 Propulsion System - Externally Pressurized Type 
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Table 4-15. Propellant Containment Assembly Features 


Assumed Characteristics 

Regulated* 

Blow Down 

• Regulated-* 
Equivalent Blowdown 

Material 

6A1-4V Ti 

6A1-4V Ti 

6A1-4V Ti . 

Operating pressure, psi 

~ 300 

- 300 

300 

Design Concept 

Safe life 

Safe life 

Safe life 

Safety factor on burst 

- 1.7 - 2.0 

~ 1.7 - 2.0 

~1.7 - 2.0 

Ground hold temperature 

-306 

-306°F 

-306 

Heatup time, hr 

~20 ' 

^ 6 

over 6 

Vapor pressure, psi 

14.7 

14.7 

14.7 

Tank pressure, psi a 

~ 14.7 

~ 300 

—14- 7 

Launch temperature, °F 

-325 

-325 

-325 

Launch vapor pressure, psi a 

4.0 (-10.7 psig) 

4.0 (-10.7 psig) 

4.0 

Design for buckling at 14.7 psia 

Yes 

Yes 

Yes 

Safety factor at normal conditions 

ft? 

1.7 - 2.0 

as 

Applicable failure rate 




From internal pressure 

0 

w 10“ 5 /day estimated 

0 

Hormal operations 

Incredible 

Very improbable 

Incredible 

Consequence of leak 

Drip 

Spray 

Drip 


*0r pressurized in orbit. 









Use of the burst/relief valve as shown in Figure 4-11 is recommended 
as better than allowing even the possibility of tank bursts* however, 
redundancy of the burst discs is recommended and caution in the location of 
the vent is needed. The TRW Capistrano Test Site does not use vent/relief 
valves. However, use of redundant burst discs appears appropriate for this 
application. A system using no vent valves would also be considered 
satisfactory. 

Use of the system shown schematically in Figure 4-1 3 described as 
■4-tank blowdown in Table 4-15, is considered acceptable if: 

<i Pressurization occurs after deployment of the spacecraft 
and separation of the orb iter 

• Extra thermal protection (insulation, etc.) is provided 
to extend the storage time to ‘well over 6 hours* (pre- 
ferably 24 hours) or if LN 2 cooling is provided in 
f 1 i ght 

Both systems, LF 2 and N 2 0^, are provisionally mandated by NASA 
Headquarters to have dump systems. The dump system would consist of 
approximately a 1 1/2-inch line size valve and line connected to the 
engine feed line (for a 1000-pound propellant load). This line size 
should allow dump of the unpressurized tank acting under vapor pressure 
alone to space vacuum in under 1 minute. The isolation valve would also 
need to be of similar size. 

If it is determined that a fast, pressurized dump is required, an 
orifice in the pressurization line below the regulator may be appropriate 
to limit pressurization of the tank during dump to a value lower than the 
normal regulation pressure. This would allow additional safety margin 
during propellant dump. 

A redundant vapor detection shell as shown in Figure 4-14 is con- 
sidered feasible and may be considered for enhanced safety on the fluorine 
system. Although this item adds some system weight, it can provide a 
positive means to assure propellant containment. Such a shell is not 


*k 

The normal time required for deployment, design for unpressurized dump 
is needed to allow dump in care of a leaking tank. 
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Figure 4-13. Fg/NgH^ Piropulsion System - 4 tank blowdown 
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Figure 4-14. LF*2 Propellant Containment Assembly - PCA and 6SE (OSE) Connections 





required for the NjO^ in the OMS kits and so, by precedent, it should not 
be required for spacecraft propulsion. 

Use of the second shell, if one is used, as a vapor detection 
cavity is recommended. For the shroud could serve as a vapor detec- 
tion cavity. Vapor detection in flight will be discussed in Task 8. 

In Figure 1-6 use of a common pressurant tank with isolation pro- 
vided by series redundant check valves, not by isolation valves, is under- 
stood to be a state-of-the-art practice. However, it raises the possibility 
of propellant contact if the check valves were to malfunction due to any 
combination of causes. This is not recommended for manned spaceflight on 
the Shuttle. Separate pressurant systems or isolation valves are recom- . 
mended. Ho manual valves should be used. 

A capping procedure is desirable for the vent/ relief line. (Caps 
are always installed on the fill and drain lines after loading.) See 
Table 4-16. 


fable 4-16. Vent/Relief Line Capping Procedure 



Vent Open 

Vent Capped 

Comments 

On ground 




Load Propellant 



TBD 

Storage 

X 


To save system in 
case of over- 
pressure 

Transport to pad 


X 

To reduce hazard 

At launch 

X 


For deployment 

During Flight 

X 


To prevent burst 

During deployment 

X 


After dump is 
di sconnected 


4.5 TASK 6 - OXIDIZER DUMP SYSTEM ANALYSIS 

4.5.1 Task Description 

4.5. 1.1 Task Statement 

Task 6 requirements are as follows: 

"Determine if an oxidizer dump system is required for the 
case of (a) shuttle abort, and (b) oxidizer system failure. 

If a dump system is recommended, then for both cases (a) 
and (b) describe the design criteria for a dump system 
recognizing the existence of a shroud over the spacecraft. 

For case (b) describe the fundamental processes that 
would govern a non-catas trophic leak of the oxidizer into 
the shuttle bay and its effect on the shuttle and payload 
hardware. Determine the disposition of the oxidizer con- 
sidering vaporization and diffusion rates and concentra- 
tion gradients." 

4.5. 1.2 Analysis Approach 

General Approach and Summary . The general approach used in this 
task was to (1) define the mission operational sequence, (2) define system 
characteristics, (3) perform a hazard analysis and postulate corrective 
actions and hardware, and (4) compare alternative dump system options in 
view of the hazard analysis. 

The "hazard analysis" format used is very similar to the hazard 
analysis described in Section 4.1 of this report, although in this task 
two slightly different hazard analysis formats were used. The first for- 
mat was used to analyze the "primary .hazards" that exist or may exist, when 
launching the Mariner spacecraft and the IUS/TUG when using LFg and NgO^ 
during normal mission operations (includes Orbiter abort operations) and 
.the abnormal operations that may occur during an unplanned extended mission 
and other conditions. See Appendix (9) for this analysis. 

The second type of hazard analysis fonnat was used to analyze 
secondary hazards that exist or may exist during dump of the oxidizer 
during launch, orbital, and abort conditions. See Appendix (9) for this 
analysis. From the primary and secondary hazard analyses the information 
needed to answer the Task 6 is derived. Appendix 9 is summarized in 
Figure 4-17. 
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■WIONS 

^ 1 ) 


MISSION 

PHASE 

( 2 ) 


PRIMARY 

HAZARDS 

(3) 


I 1) Lift off of orbiter 2) Internediate leak through the 

<:*^al to SRI-S separation primary tank wall and the outer 

^■‘ations leak protection shell. 

3) Vent of Fg through vent/relief. 


MAJOR CAUSES 
OF HAZARDS 
(4) 


o Normal vibration, 
acceleration or 
shock* 

o External hazards to 
the payload ; e .g . , 
rupture of pressure 
vessels, fire 
hazards to payload 
from the tug and 
orbiter, etc. 

o Overpressurization 
of the LF 2 tank 
from the He tank. 

o Smell fire external 
of the tank could 
be caused by small 
leak igniting non- 
metal lies or fuel 
vapors. 


LIKELIHOOD OF 
HAZARD CAUSES 
( 5 ) 


Improbable 


improbable 


Improbable 


Improbable 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
( 6 ) 


ORBITER 

(Current Effects) 

Burn through the snroud may occur 
and allow gas to leak into the 
cargo bay. 

(Delayed Effects) 

Continued corrosion due to earlier 
leak. Also possible over- 
pressurization of shroud and fire 
in the shroud which if released 
would cause extensive damage. 

ORBITER PERSONNEL 
(Delayed Effects) 

Possible damage to space suits and 
possible injury personnel if 
1VA is performed and toxic and 
corrosive gas hazard exists 


holdout 


wmm 


ORIGINAL BASE B 
OF BOOB QUALITY 
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►UMMARY OF PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 


RISK SAFETY 

CATEGORY CONTROLS & ASSUMPTIONS 

(7) ( 8 ) 


REMARKS 

(9) 



If an intermediate leak occurs, the 
e shuttle orbiter should continue to orbit 
or gain altitude to quench fire and dump 
propellant and RTLS. The $/C mission 
should be cancelled. The orbital leak 
procedure (dump or deploy) should be 
instituted 

Assumed a special arbiter LFj compatible 
dump system is used for dumping the LF 2 . 

The earliest time possible to open the 
cargo bay doors is T = 22 minutes , 

S/C design is that assumed in Table 2. 

The gases in the orbiter cargo bay are 
continuously vented during boost 
operations* 

Prior to boost, the cargo bay is purged 
with N 2 gas. 

The shuttle crew area is isolated from 
the cargo bay area during boast via an 
airlock. 

The LF 2 tank has a fluorine compatible 
shell around it to contain any “fuzz 
leaks 11 or "intermediate leaks," 

The time the orbiter is exposed to a 
fuzz leak will be small. If a fuzz leak 
occurs, the buttle should continue to 
orbit then proceed to the orbital leak 
procedure. 

The complete S/C is covered vrith a shroud 
which isolates leakage gases from the 
orbiter. 

The shroud is designed to be as resistant 
to F 2 as possible. 

The shroud is designed so as not to 
contain significant pressure buildups. 

The shroud must also be vented to the 
outside of the orbiter cargo bay to allow 
pressure relief from inside the shroud 
on ascent. 

Once the leak is detected, the LFj 
may be dumped. 

Personnel not allmv-ed in the cargo space 
in any phase of flir when there is a 
leak in the LFj> tank. 

Assumed that instruments are aboard that 
can detect a leaking f 2 tank. 


1) All aspects of specified controls are comparable for N 2 O 4 
except that the normal orbiter hypergolic dump lines can be 
used. The shroud would replace the second tank wall as a 
leakage barrier. 

2) This page of the analysis assumes dump lines will be 
mandated by NASA. 

3) Ascent to altitude will moderate all leakage effects provided 
vents are open. Lea<age around the door is expected to 
provide some venting even when vents are closed. 


^Return to Launch Site 
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MISSION 

PRIMARY 

OPERATION 

PHASE 

HAZARDS 

(1) 

(2) 

(3) 

I 

Normal 

2} SRM Separation 

Z) Intermediate leak through the 

Operations 

to MECO 

primary tank wall and the leak 

(Continued) 


protection shell. 


3A) Earliest opening 

1) Intermediate leak through 


of cargo bay doors 

the primary tank wall and the 


to deployment of 
the S/C and IVS/ 

outer leak protection shell. 


TUG into orbit. 


>ldodt 

ERA1S ) or: 
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j 
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of 

POOR QUALITY 
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nyOR CAUSES 
OF HAZARDS 
(4) 


* Same as for Mission 
Phase 1, Primary 
Hazard (2), 

t High shock loads to 
the payload due to 
SRM separation. 

• Longer period of time 
time for leak througi 
to occur than for 
Mission Phase (1). 


SUMMARY 


I 


LIKELIHOOD OF 

HA7A*D EFFECTS ns 

HAZARD CAUSES 

SHUTTLE ORBITER 

(5) 

(6) 

Improbable 

ORBITER 


(Current Effects) 

Improbable Leak throu 9h of the shroud will 

cause damage to cargo bay due to 
corrosive gases- 

Improbable 


ORBITER (Continued) 


(Delayed Effects) 


Same effects as for primary 
hazard (2) of Mission Phase (1) 
above. 


ORBITER PERSONNEL 
(Delayed Effects) 

Same effects as for primary 
hazard (2) of Mission Phase (1) 
above. 


• Fire external to the Improbable 
tank. Could he 
caused by small leak 
igniting hardware or 
fuel vaoors that 
exist in the area. 


ORBITER 

(Delayed Effects) 
Same as Phases 1 and 2 above. 


• Excessive heat trans- Improbable 
fer through the 
thermal coating 
causing early rapid 
pressure rise in the 
LFr, tank. Failure 
to disconnect all 
appropr ate 1 ines 
and connections to 
the orbiter before 
deployment of the 
payload into orbit 
(e.q., dump line), 
and other mechanical 
interfaces. 


ORBITER PERSONNEL j 

(Delayed Effects) j 

Possible toxic and corrosive gas ] 
hazard in the cargo bay and could 3 

cause damaoe to the IVA suit, then ' 

possible injury to personnel. 

Same as Phases 

Possible injury to other arbiter . 
personnel if the hazard 
propagates. 
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>F PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 
(CONTINUED) 


P1SK 

:hegory 

(7) 

SAFETY 

CONTROLS 6 ASSUMPTIONS 
(8) 

| 71 

REMARKS 

| (9) 





■ 

in, 

II possible 

See appropriate section of the primary 
hazard analysis for detail safety 
controls and desinn requirements. 



■ 

i; 

II 




/; 

ill, 

11 possible 
;{ improba- 
ble) 

Same as for Operation I* Mission 
Phase 1* 

1, See Mote 3 above., 

2. Sinnificant spills of fuel and oxidizer required to allow 
combustion in hard space vacuum with the cargo bay doors 
open. Continuing flow of fuel and oxidizer would be 
required to damage the carqo bay. 


; 

■ i 

.III. 

11 possible 

Sense overpressure and dump propellant. 
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SUMMARY OF PRI 



PRIMARY MAJOR CAUSES LIKELIHOOD OF HAZARD EFFECTS OH 

HAZARDS OF HAZARDS HAZARD CAUSES SHUTTLE ORBITER 

(3) (4) (5) (6) 


2} Explosive rupture of the 
oxidizer tank due to high 
internal tank pressure* 

1) Venting of LF? through 
vent relief* or 


o Same as for Mission 
Phase 3A above. 

o Mainly because of heating 
of LF2 due to extended 
time without coolant. 


Improbable 

o There is a 1 00 ; chance 
the tank will rupture 
if there is no cooldown 
capabi 1 ity or dump 
capabi 1 ity in the time 
allowed. 


ORBITER 

(Delayed Effects) 

Possible corrosion to 
external surfaces of the 
arbiter including optica 
surfaces. The extent of 
the effects depends on 
if the shroud has been 


removed and when the 


incident occurred. 


OR BITER PERSONNEL 
(Delayed Effects) 

Damage to space suits if 
IVA or EVA is necessary. 
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OF PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 


RISK 

SAFETY 

CATEGORY 

CONTROLS & ASSUMPTIONS 

0 ). 

(3) i 


See appropriate section of the primary : 

Ill, IV 
II possible 

legend analysis for other detail safety 
controls. 


1. Use vent relief with redundant burst 


discs; ducted overhead 


2. Do not allow IVA or EVA if tank 


pressure Is near vent/relief level. 

3. Kay need a dump line reconnect 
capabi 1 1 ty 


III, 

II possible 


HOLDOUT IR &Mg 



MISSION 

HAZARDS (3) 

MAJOR CAUSES 

LIKELIHOOD OF ! 

OPERATION 

0) 

PHASE 

(2) 

PRIMARY 

SECONDARY 

OF HAZARDS 
(A) 

HAZARD CAUSES 
(5) 

I 

formal 

Operations 

(1) Unscheduled S/C 
propellant off-load 
between Lift-off 
to MECCL 

1) Inter- 
mediate 
leak and 
larger 
leaks up to 
rupture of 
the oxidi- 
zer con- 
tainer 

1) l?2 and ?2 9 as 
escaping from the 
dump system into the 
orbitsr. 

0 Contaminated off- 
load system. 

Improbable 




2) Explosive reactions 
in the off-load 
system. 

0 Contaminated off- 
load system* 

Improbable 


(2) MECO to earliest 
cargo bay doors 
can be opened 
(t + 22 min. ) 

Same as for 
Mission 
Phase (1) 

1} LFg and F2 9 as 
escaping from the 
dump system into 
the orbiter. 

0 Contaminated ■ 

dump system. 

Improbable 

PQLDpipj 

l.mME j 

O Q 

xMAL PAGE IS 
POOR QUALM 





(Delayed Effed 


Damage to I VA suit? 
possible injury to 
nel because of sum 
because of personn 
into the cargo bajj 
when toxic and cor. 
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JMMARY OF SECONDARY HAZARD ANALYSIS FOR TASK 5 AND 6 


r FECT5 ON 
ORBITER 

5) 

RISK 

CATEGORY 

(7) 

ITER 

‘III, 

II possible 

t Effects) 

equipment 

Possible 

. PERSONNEL 


d Effects) 

II, 

* IVA suit 

(Damage to the 

injury to 
a result of 
ilem only if 
mnel enter 
f when the 
rard exists. 

IVA suit.) 


SAFETY 

CONTROLS & ASSUMPTIONS 

( 8 ) 

1. Assure that off-load (dump) system 
is clean with sealed in helium or 
nitrogen, 

2. Passivate the off-load dump system. 

3. Use no non-metal lies except teflon 
near dump line. 


TER 

Effects ) 

may occur and 
orrosive 


III* 

II possible 
depending on the 
cost of damage, ; 


1 . See Above 

See appropriate section of secondary 
legend analysis for additional safety 
controls 


PERSONNEL 

Effects) 

A suit and 
ury to person- 
of suit damage 
ersonnel entry 
go bay area 
nd corrosive 


II, 

{Damage to IVA 
suit. } 

(Improbable) 


-I 








MAJOR CAUSES 
OF HAZARDS 
(4) 


LIKELIHOOD OF 
HAZARD CAUSES 
(5) 


hazard EFFECTS m 
SHUTTLE ORBITS^ 
(G) . I 


Contamination of 
the off-load (dump) 
system 


o Contamination of 
the off-load 
(dump) system. 

o Fuel vapors in 
off-load system. 


Improbable 


Improbable 


Improbable 


QR&ITER PERSONNEL ; 
(Current. Effects) ' 

Space suits vii 1 1 be 
damaged if personnel 
enter the cargo bay 
during IVA and the F 2 
gas exists in the are 
in a sufficient con- 
centration. Person 1 
space suit may be 
injured also, 

0 RBJTE & I 
(Current Effects) 

Corrosive damage to 
main engine space arid 
the orbiter cargo bay 

(Delayed Effects). 

Corrosive and fire 
damage to the main 
engine space. 

ORBITER PERSONNEL 
(Delayed Effects): 

Possible crash landiri 
due to damage to the ] 
main engine space, j 
Al so toxic vapor haza 
once landed. ■ 







DF SECONDARY HAZARD ANALYSIS FOR TASK 5 AND 6 


:ner preferred system 


RISK SAFETY 

TEGORY CONTROL & ASSUMPTIONS 


( 7 ) 


(8) 


ible 


1. Assure that the off-load dump system 
is clean with sealed in helium or 

ni trogen , 

2. Propellant dump creates a mission abort. 


■ible 


ble 

i of the 
■ damage 


1 . Assure that the off-load (dump) system 
is passivated and clean with sealed 
in helium or nitrogen. 

2, Provide procedure for saving the 
fluorine systems after landing even 
if they have been dumped. 

See appropriate section of the secondary 
legend analysis for additional safety 
controls. 


;i ble 
tab! e) 


Ftptpour w&ms -4^ 


3 

-L 


OPERATION 

( 1 ) 


II 

RTLS 
Abort 
(Cont. ) 


MISSION 

PHASE 

( 2 ) 


Lift-off to MECO (Cont. 


FOIXTO UT gR PGB / 


HAZARDS (3) 


PRIMARY 


Same as for| 
Mission 
Phase I 


SECONDARY 


2 ) 


Hazardous LF 2 and 
Fj? gas flowing from 
dump system nozzle 
in conjunction 
with other propell- 
ants* The gas may 
enter the cargo bay 
area by ingestion 
into the cargo bay 
vent system. 


MAJOR CAUSES 
OF HAZARDS 
(4) 


Always exits 
during normal 
off-load oper- 
ations. 


ORIGINAL PAG$ IS 
OF POOR QUALITY 


LIKELIHOOD OF 
HAZARD CAUSES 
{5} 


0 Always occurs. 


There is a 

chance that a signifi- 
cant corrosive hazard 
will exist for the 
external and internal 
surfaces of the orbiter 
if safety controls are 
not implemented 


sh mt 


HAZARD EFFECTS DM 
SHUTTLE ORBITER 
( 6 ? 


ORBITER 


(Current Effects) 


[Corrosion of external and 
internal orbiter sur- 
faces* Possible damage 
to all glass* plastic or 
optical surfaces* 


(Delayed Effects) 


[Possible fire and 
extensive corrosion in 
the cargo bay* 


ORBIT PERSONNEL 


(Delayed Effects) 


Passible toxic gas 
hazard in the cargo bay 
after landing. 














SUMMARY OF 


PREFERRED SYSTEM 


SAFETY 

lY CONTROLS & ASSUMPTIONS 


( 8 ) 


ble 
ig on 
: and 
leslgn 


See appropriate section of the secondary 
analysis 

1. Close vents during propellant off-load 
(dump) , 


2, Exercise caution on entering cargo bay. 


i ble 
ig on 
:le 

md its 


ible 
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Dump alternatives are shown in Section 4. 5. 3.1. Only the selected 
alternative was considered in the hazard analysis. 

In addition to performing the above hazard analyses* a qualitative 
hazard analysis tradeoff was made to determine if it was safe to land the 
orbiter with LF 2 in the tank or to dump the LF 2 in flight, then land the 
orb iter. 

Foundational Data for the Hazard Analyses 

To perform the hazard analyses and thereby derive the data needed 
for Task 6, several bits of data had to be correlated and defined, includ- 
ing operation, design characteristics and possible actions. The data 
required was a detailed description of the various operations to be per- 
formed during a normal mission (obtained from mission profiles), during the 
abort missions, and during normal missions when unplanned orbi ter/payload 
anomalies occur. Also ground operations at primary and secondary landing 
sites had to be considered, various possible payload configurations and 
oxidizer removal systems were defined, orbiter operational and design data 
was determined, and possible modes of corrective action were determined for 
various hazards that might occur during various mission phases. 

Mission Operations . For this study mission operations consist of 

normal and abnormal operations. All of these operations are described in 

the DOD "Space Shuttle System Summary," 1 August 1974, Capt. Paul H. 

* 

Kruppenbacher, SAMSO/LVRE. This document describes the NASA as well as 
the DOD missions. Also SSV74-32, "Space Shuttle System Summary," August 
1974 was used to define mission profiles. Under the normal missions, the 
mission profile for the 65,000-pound payload was assumed, also for the 
purposes of this study, an unplanned extended mission was considered as 
part of the normal mission profile. The abnormal missions were the abort 
missions, crash landings, and landings at secondary landing sites. 

For the normal mission, it was assumed to have the following 
basic mission phases: 

e Lift off to SRM separation. SRM separation occurs at 
approximately 122 seconds. 


*Part of the Air Force space and missile organization. 
Solid rocket motors. 
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• SRM separation to Main Engine Cutoff (MECO). MECO is at 
481 seconds. 

• MECO to mission injection. Mission injection occurs at 
T = 588 seconds. The OMS is fired after MECO to boost 
AV 100 fps. 

After mission injection, the earliest time the cargo bay 
doors can be open is T = 22 minutes. 

« Mission injection to apogee. Apogee kick occurs in the 
first orbit and occurs at about T = 35.9 minutes. The 
first orbit is a 50 x 100 nautical miles. 

• Apogee to circularization occurs normally in the 
eighth orbit. 

■ Circularization to predeployment activation and check- 
out. Checkout occurs after attaining orbit circulariza- 
tion and the cargo bay doors are normally opened at this 
time (approximately one orbit). 

• Activation and checkout to payload/TUG or IUS deploy- 
ment occurs at within three orbits. 


• The sequence is: Payload/TUG/ IUS deployment; payload/TUG or 

IUS checkout and release; and TUG activation. 

» The TUG and orbiter are separated about 1500 to 2000 feet 
from the TUG when the TUG is fired. 

• Unplanned extended hold after the cargo bay doors are 
opened at T = 11 hours to when normal mission opera- 
tions are considered. 

Abnormal operations were assumed to consist of the Return to 
Launch Site (RTLS) and Abort Once Around (A0A) abort operations, crash 
landing and normal landings at secondary launch sites. Of the above 
operations, the hazard analysis was performed on the most dangerous oper- 
ations only. The RTLS abort mode and the crash landing were considered 
the most dangerous operations. The RTLS abort mode consists of the fol- 
lowing mission phases: 

e Same as for normal mission up to SRM separation at 
T = 122 seconds 

• SRM separation to last RTLS point (+ = 242 seconds.) 

The two orbiter main engines continue to burn at 
100% EPL until the propellants in the ext rnal tanks 
are expended. The entire OMS propellant supply and RCS 
propellants are expended as soon as possible during RTLS. 
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• Last RTLS point to MECO at T “ 561 seconds. 

• MECO to External Tank (ET) release at approximately 
T = 561 seconds. 

« ET release to shuttle lands with power off. 

Normal landing will be at the landing strip at KSC. The 
secondary landing sites will be Patrick Air Force Base in Florida 
or Vandenberg AFB, California. A crash landing may occur at any one 
of the above landing sites. 

System Design Characteristics . In the hazard analyses previously 
mentioned two different oxidizer related system designs were evaluated. 

One system design concept was the Shuttle/Mariner Baseline System and the 
second concept considered was the Shuttle/Mariner Preferred System. The 
baseline system is considered a nominal system, whereas the preferred sys- 
tem is considered a much lower risk system because of the design character- 
istics that control the hazards and minimize the chance of hazard occur- 
rence. The design characteristics of these systems was shown in Table 2-1 


In addition to payload design requirements, the STS* design and 
operational constraints were considered. Some of the significant con- 
straints are: 

c The earliest the cargo bay doors can be opened is 
T = 22 minutes after launch. 

• There is no fixed flooding fire extinguishing system 
aboard the shuttle orb iter. 

* There is no means to purge the cargo bay once it is 
launched. 

All the data on the STS* design was taken from JSC 07700, Vol . 14, 
Rev. C "Space Shuttle System Payload Accommodations." 

Space Transportation System 
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Corrective Action . In performing the hazard analysis it was neces- 
sary to determine potential modes of corrective action during various 
normal and abnormal mission phases. Therefore, an analysis was performed 
to determine these corrective action modes for the postulated hazardous 
conditions which may occur in the mission phases. The following modes of 
corrective action were determined to be acceptable and were used in the 
hazard analysis: 

• Launch Phase (normal mission). The only corrective 
action possible during launch is to drain the 
oxidizer via a dump system. This is the only mode 
possible up to +22 minutes, which is the earliest 
time the cargo bay doors can be opened. 

• Orbital Injection and Orbital Operations (normal 
mission). During this mission phase, the oxidizer may 
be off-loaded by dumping or by deploying the payload 
(contains the oxidizer). Depending on the design of 
the payload, other off-load modes may be possible such 
as vent the oxidizer from the oxidizer tank directly 

to space from the cargo-bay. One other corrective action 
considered in the study was to return to the launch site 
with the propellant. 

• Return to Launch Site (abort mode). During this abort 
condition it was assumed that the only oxidizer disposi- 
tion mode tenable was to dump the oxidizer after SRM 
separation. It was not considered a desirable cor- 
rective action to land with the oxidizer aboard the 
shuttle because of the risk of crash landing or having 
to perform a normal landing at a secondary landing 
site. 

4.5.2 Design Criteria/Shuttle Abort 

The design criteria for jettisoning the oxidizer during the Shuttle 
abort modes may be categorized as due to operating constraints and orbiter 
safety considerations and ground safety considerations. 

The design criteria that should be considered in the dump system 
due to abort operating conditions are: 


1 


I . 


J 


l 
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• During the RTLS abort, the oxidizer must be dumped 
before other hypergols and propellants, probably 
immediately after the last RTLS time (T = 242 seconds). 

• The propellant must be dumped in a very short period of 
time (TBD) to allow time for the other propellants to 
be dumped. 300 seconds are allocated for all. 

• All propellant must be dumped in the time allowed. 

• During an AOA abort, the propellant is to be dumped 
after orbit is achieved. 

• Propellant should not be dumped below several thousand feet 
because of atmospheric contamination. Safety of the Orbiter 
is the overriding concern, however. (Plans call for no dumps 
below 100,000 feet.) 

• The dumping of propellant should occur only after SRM 
separation. 

The design criteria that should be considered on the dump system 
due to other safety considerations are: 

• The dump system must be compatible with LFg. 

s A specially designed vent system may be provided 

to offer a secondary means for slow dumping, in orbit. 

e The normal orbiter 0MS kit (earth storable) hypergolic 
dump system cannot be used without major modifications 
for should be adequate for 

t The dump system must be passivated before launch and 
leak tests must be performed to determine that the <. 
dump system is leak free. A positive pressure of He 
gas must be maintained during all mission operations. 

This pressure must be monitored by the engineering data 
system aboard the Orbiter and the caution system activated 
if it is determined that a leak has occurred. The leak 
detection system must be designed such that the leak rate 
in the dump system can be ascertained, so that correct 
procedures can be determined. 

a The dump system is to be sealed off on both ends, so that no 
contamination can enter. 

•' The dump system must be designed to contain low order pressure 
surges of the type that occur when minor contamination and F« 
gas mix, without leaking. 
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• All possible joints in the dump system should be welded and 
of the same quality, of weld used on the spacecraft oxidizer 
system (except disconnects, of course), 

0 A warning plate shall be placed on the dump system in 
conspicuous places indicating that the system contains 
a hazardous gas (see warning signs required by the OSHA 
for information required on the plate). 

t The dump system should be designed so that the valves 
to the system can be automatically opened when a dump 
is required. The command for dump shall be initiated 
by the orbiter crew. 

0 The passive portions (piping) of the dump system shall 
be designed to be fail safe. All valves and controls 
shall be designed to be fail -fail -safe. 

0 The dump system shall not have a relief valve or vent 
valve, which could leak during passivation, etc. 

e The dump system piping shall be routed such that there 
will be minimal damage if a hazard occurs. 

0 The operating pressure in the dump system should be 
kept as low as possible. The dump system shall be 
designed to have a safety factor of at least 3.0 under 
worst case conditions; this would include dumping when 
the pressure in the oxidizer tank is at the MEOP value, 

• Only metal seals* should be used for LF2 and only where 
it is absolutely necessary to have a mechanical joint. 

0 Assure there are no sections in the piping that will 
cause pockets of LF2 to exist or cause pockets of F2 
gas to exist. 

0 Assure that the dump system piping is isolated from 
all sources of fuel vapor. 

0 Consider an outer shell around the dump system piping*** 

0 The dump system piping must be capable of enduring the 
thermal shock of the dump process. 

0 Assure that the outlet of the F2 dump system is located 
so that any possible backwash of the F2 gas during 
dumping is minimized. 

0 Allow no joints in the dump piping between the attachment 
to the payload to the Orbiter main engine bulkhead. 


Such as the AFRPL bobbin seal. 
**Must be insulated, may be vented 
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• Design the exit nozzle of the dump system so that the 
external orbiter surfaces will not be damaged under 
any dump conditions. 

• The dump system shall be designed so that it will not 
collapse due to low internal pressure and normal 
external pressures. 

4.5.3 Design Criteria/Oxidizer S.ystem Malfunction 

• 

In general the design criteria for the dump system is the sattfe as 
that required in Section 4.5.2, "Design Criteria/Shuttle Abort,” Some of 
the design requirements that are peculiar to oxidizer system malfunction 
are: 


• The propellant should be dumped at the first moment that is 
safe for the Orbiter. 

• The dump system interface with the payload should be 
designed so that it will readily disconnect safely 
from the payload when the payload is being deployed. 

A redundant disconnect mechanism should be designed 
so that the oxidizer tank is not damaged if the pri- 
mary disconnect fails. An alternate solution would 
be to assure that the disconnect is fail-safe. 

4.5.3. 1 Oxidizer Dump System Tradeoffs 

LF,, and NgO^ Dump Considerations 

One of the basic questions of Task 6 addresses is whether a dump 
system is required during abort operations and if an oxidizer tank failure 
(leak) occurs. A hazard analysis was performed, as previously mentioned, 
and it was determined that a dump system is desirable in this event. Of 
course the systems should be reliable enough that either event is an 
exceptional one, 

A review of the primary hazard analysis (Appendix 9) reveals that 
there are several hazards to the orbiter and its personnel if a dump sys- 
tem is not available. In addition to the vacuum of space which removes 
propellant rapidly, the dump system provides the only means to mitigate a 
hazard during certain phases of flight where the cargo bay doors are closed, 
such as during the RTLS abort condition. Even if a hazard event does not 
occur to the LFg of ii,0X tank it is desirable to off-load the propellant during 
the RTLS abort to reduce the effect of hazards to the oxidizer tank and to 
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lower the risk to the orbiter, and flight and ground personnel during 
various landing conditions (e.g., crash landing and landing at alternate 
landing sites for the RTLS abort conditions present special problem areas). 

Since one of the payload safety requirements is "a safe interface 
between the Shuttle and its payload shall be maintained under nominal, 
contingency, and emergency operations of either the Shuttle or its payload," 
it has been interacted that it is necessary to supply the dump capability 
during all mission phases where deployment of the spacecraft and IUS/TU6 
cannot be achieved. The times when this may occur are from liftoff to 
T + 22 minutes on a normal mission and during the RTLS abort. The dump 
system also provides a capability for hazard control if for some reason 
the payload (spacecraft and IlfS/TUG) cannot be removed from the cargo bay 
when required. If this occurred after excessive warming of the tank has 
occurred, the dump system would be the only means available to protect the 
orbiter and its personnel from a catastrophic incident unless the oxidizer 
tank is designed with a vent system as indicated previously. Since the 
dump system is planned, other systems are not necessary. 

For the RTLS and AOA abort conditions it is considered necessary 
to dump propellant before landing because of the increased risk to the 
orbiter and its personnel if a crash landing occurs and the increased risk 
to ground personnel and the general public if the orbiter has to land at an 
alternate landing site: the airports will not have the facilities required 
to safely handle liquid fluorine at a time when the LF 2 is more hazardous 
than any previous phase of the mission including handling at KSC. This is 
because of the increased pressures in the tank due to the normally slow or 
possibly accelerated heating of the propellant, from abnormal conditions in 
the cargo bay. 

It is also felt that although it is feasible to design the oxidizer 
tank to undergo crash landing stresses, the risk from other systems to the 
oxidizer tank during a crash landing should be considered. 

Fundamental Process Oxidizer Dump System Design Characteristics 


1 


Fundamental processes that would govern a noncatastrophic leak 
include: Propellant leakage, vaporization, flash freezing, sublimi nation, 

diffusion, impingement, molecular motion and possibly, ignition. Some of 
the considerations related to effects of noncatastrophic leaks are: 

■ Leak rate, a function of fluorine pressure, ambient 
pressure (if any), hole size, and to some extent, LFp 
temperature 

i Vaporization and diffusion rates (if there is an atmos- 
phere into which to diffuse) 

• Presence or absence of reactable fuel vapors and their 
concentration 

• Presence or absence of liquid or solid fuel, capable of 
being ignited 

• If in the presence of water, corrosion. 

Simply restated, the leak can be expected to be noncatastrophic if 
the leakage is small enough that no appreciable vapor pressure is built up 
which could cause reaction and heating of components. 

It should be noted here that a 5 psi vapor pressure of is used 
for typically 1 hour to create a passivation layer in test hardware after 
which pressure increases to 50 or 100 psi are commonly used. Thus a 5 psi 
pressure would not be expected to damage reasonably thick sections of 
clean aluminum, citanium or stainless hardware. In space, all volatile 
contaminants on the surface of hardware can be expected to disappear rapidly. 

At low pressures as would be expected above 50 to 100,000 feet or 
when leaks are small compared to the weight of air or nitrogen purge in the 
cargo bay, reaction with combustible nonmetal lie materials is of most con- 
cern. If ignition were to occur at low altitude, it may extinguish at 
altitudes. Example: Volume of the cargo bay is nominally 65 x 15 feet and 

contains more than 11,486 cubic feet. 

If the entire 1000 pounds of oxidizer were suddenly released and 
flashed to vapor at-306°F absorbing a quantity of heat equal to its latent 
heat of vaporization, a pressure of approximately 4 psi would result in the 
cargo bay. Naturally this could not occur instantaneously and a combina- 
tion of vapor droplets and solid frozen fluorine snow might result. Under 
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zero g conditions vaporization would take several minutes. Spill tests at 
the Air Force rocket propulsion laboratory indicated several minutes were 
required to vaporize spills into a tray even where reactants were provided. 

Small leaks can produce no appreciable pressure in the cargo bay 
if the vents are open since they contain an area of several square feet. 

Based on experience with attempting to obtain hypergolic ignitions 
of earth-storable propellants in rockets at low chamber pressures, it was 
found that reliable ignitions at less than 1 psi pressure with 
and amine (hydrazine based) fuels were difficult to obtain probably due to 
the low temperature resulting from the evaporation process. Although simi- 
lar data for LF 2 has not been found, it is expected that rather gross leaks 
would be required to ignite hardware in the cargo bay at altitude unless 
there was direct impingement and recovery of velocity heads of the leak 
steam. Fire can be expected to extinguish when the fuel is consumed. 

Although testing should be performed with materials of interest 
(such as insulation and electric wiring) in vacuum chambers, ignition in 
the cargo bay by less than an "intermediate" leak is considered improbable 
to incredible (<10" 3 occurrences per launch) since vapor pressure of lF 2 
would be so small as to preclude significant heating. Leaks intermediate 
or larger are considered improbable in themselves and are expected to be 
from external causes, e.g., failure of other equipment. 

Thus the hazards from low level leakage in vacuum are considered small. 

Dump Alternatives 

It was concluded that there are at least six alternatives for 
emergency propellant off loading. These may be described as follows. 

Dump Kit Peculiar Fluorine (DKPF) Selected for LF ? . This is an 
independent dump system or kit designed to be added to the Orbiter and IUS/ 

TUG to accommodate for the LFg/N^H^ propulsion system or an adaptation of 
other lines to make them compatible with the propellants. Possible advan- 
tages include: (1) ability to dump at any time in gravity fed, vapor 
pressurized or helium pressurized modes, (2) satisfaction of the require- 
ment defined by the Level 1* safety document, (3) provision of a vent 
function, (4) elim ination of the need to design for crash and landing 
NASA Headquarters 
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site problems, and (5) it is believed that safety approval* can be obtained 
if this approach is used. Disadvantages include: (1) system would be 

costly in that a new larger line size propellant valve would be needed 
(<1 inch line size), (2) introduction of other hazard modes, i.e., the 
dump line, and possible valve leakage, the system requires passivation 
in the PCF or OPF, with F 2 gas and (3) involves the IUS/TUG and/or Shuttle 
Orbiter interfaces. 

Through Doors Dump . This system would vent propellant through the 
doors either when they are open or by means of a small protrusion through 
the doors. This system has the advantages of: (1) no IUS/TUG interface, 

hence, less cost; (2) it would be adequate for many hazards but is not 
suitable for use before altitude is obtained (after altitude is achieved, 
need for the dump kit is decreased); (3) it would operate even if the pay- 
load jammed during deployment or after a DKPF would have been disconnected. 
Its disadvantages include: (1) limitations on dump times, and (2) possible 

problems with plume impingement. (Considered for completeness.) 

Use of QMS Kit Dump Lines . The OMS Kit dump lines appear suitable 
for N 2 0 4 and MMH and for N 2 H 4 fuel but would not normally be suitable for 
LF 2 , because it is cryogenic, and requires passivated, compatible materials* 

No Dump Lines . In this option, only inherent capabilities of the 
system would be used. It is assumed off-loading of the propulsion system 
could only be done by deployment of the spacecraft or an Orbiter landing 
and removal of payload in the Orbiter Processing Facility. Improvement of 
the probability of containment of the propellant can be accomplished by 
increased strength of the tank, tank damage protection, redundant isolation 
values and double walled tanks. Advantages of this system include: 

(1) minimum secondary hazards due to the dump system, (2) low cost, and 


*Because it is entirely equivalent to the system to be used for other pro- 
pulsion systems, i.e., the OMS kits and the IUS/TUG. 
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(3) highest possibility of mission success due to least compromise of 
IUS/TUG and Shuttle hardware. 

Use QMS Kit Dump . This alternative would utilize the OMS kit dump 
lines essentially "as is." This is considered unsuitable as the lines for 
LF 2 need to be designed to handle cryogenics and be passivated and capped. 
The OMS Kit lines are presumed not to have these capabilities. 

Another approach would be to mount the spacecraft sideways so that 
the rocket engine could be fired through the open doors to eliminate pro- 
pellant. This is not considered very practical. 

4. 5.3.2 Flight Hazard Analysis Summary 

The hazard analysis (both Levels I and II analyses) Appendix 9, 
summarized in Table 4-17, indicates that there are several conditions that 
present a significant risk to the Orbiter and Orbiter personnel, but it is 
believed that through design and hazard control the risks may be held to 
an acceptable level for the Mariner/Shuttle program; the risks should not 
be greater than other risks that the Shuttle Orbiter must be exposed to 
due to its own design and operating concepts. 

Under certain conditions there will be some residual hazards that 
are rated as Category I or II hazards. These hazardous conditions result 
from double malfunctions such as: 


• Crash landing after an RTLS or other abort with FL 2 still 
in the oxidizer tank. (Failure of sensing system and/or 
crew or failure of the dump system.) 

e Failure of cargo bay doors to open with the baseline 
system installed and an unplanned extended mission of 
over 20 hours and a dump system failure. 


The preferred system incorporates the features described in the 
third column of Figure 2-1. 

As previously mentioned in the Hazard Analysis Approach section 
(4. 5. 1.2) of this report, all mission phases for normal and abort conditions* 
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were not analyzed via the hazard analysis format found in Appendix 9. As 
a result of a general review of all the operations that the oxidizer tank 
may see, only the most hazardous operations were analyzed. A summary of 
the hazards and their effects and their chance of occurrence for the normal 
and abort missions are shown in the Primary Flight Hazard Analysis summary 
in Appendix 9. A summary of the hazards and their effects for the pro- 
pellant off-load modes is shown in the Secondary Flight Hazard Analysis 
summary in Appendix 9. 

A review of all the potential operations reveals that the following 
would be high risk operations: 

• Any crash landing with LF 2 or N 2 H^ aboard. 

• Unplanned extended mission while in orbit when near the 
20-hour LF 2 tank warm-up time limit. 

• Landing at alternate landing sites with LF 9 or N 9 H0 A 
aboard. 

• RTLS abort. 

a Normal mission folloiwng an extended hold on pad which 
occurs during placing of loaded spacecraft and IUS/TUG 
into orbit. 

a Ground operations after an abort and LF 2 or N^CL 
has not been completely dumped. 

a Early termination of mission and the spacecraft cannot 
be ejected or deployed before landing. 

In addition to recommending that the regulated system or equiva- 
lent be used, it is also recommended that the orbiter not land with LF 2 
or NgHO^ in the oxidizer tank; in the hazard analyses performed, it was 
assumed that this would be the case. The landed spacecraft should be 
treated as though dumping is incomplete until it is verified. 
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4.6 TASK 7 - FEASIBILITY ANALYSIS 

The feasibility analysis is contained in section 4.12 as it logically 
follows the rest of the report. 

This section is placed here to maintain continuity of Task numbers. 

4.7 TASK 8 - ORBITER COCKPIT WARNING DISPLAY 

4.7.1 Task Description 

The statement of work states that this task shall consist of the 
following: 

"Determine requirements of the spacecraft propulsion system 
for caution and warning displays in the urbiter cockpit. 

Identify the action to be taken by the crew, and the result- 
ing state of the orbiter's mission following credible fail- 
ures of the propellant system. 

4.7.2 Parameters, Displays and Actions 

To determine the appropriate parameters required to be monitored to 
assure that the orbiter and its personnel would be safe, the primary and 
secondary hazard analyses shown in Appendix 9 were reviewed. It was deter- 
mined that there are several analog and digital parameters that should be 
monitored to assure orbiter and personnel safety. In determining the 
parameters to be reviewed it was assumed that the Mariner/Shuttle preferred 
system design would be flown in the Orbiter, the safety considerations for 
this design are described in Figure 2-1. 

Caution and warning definitions*for the Shuttle are: 

Caution - notification of an impending unsafe condition. Corrective 
measures are required immediately. 

Warning - an indication that the safe limit has been exceeded and 
emergency procedures are to be initiated. 

Leakage and overpressure are the two critical conditions which could 
endanger the Shuttle and crew. Monitor of parameters which indicate potential 
or existing leakage or rising pressure are indicated. Precautionary actions 
could include: 


That were in use during the study. 
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1) No response in case of a leak through the primary barrier or 
other critical anomaly 

Z) Additional surveillance of an anamalous condition 

3) Preparation for propellant dump either during ascent, RTLS, 
abort or on-orbit 

4) Preparation for orbital deployment if on-orbit of the anomaly 
is not an imminent hazard 

5) Propellant dump 

6) Payload deployment (for non-payload disabling anomalies) or 
jettison (for payload disabling anomalies) of the payload 
spacecraft . 

Propellant dump, deployment or jettison of the payload or space- 
craft could, of course, also result from anomalies in other subsystems than 
the spacecraft retropropulsion. 

4.7.3 Parameters to be Monitored 

Due to the many situations that may be the cause of a hazard, 
several parameters must be maintained to first determine what condition or 
potential condition exists and the rate at which the condition is changing. 
The rate is needed so that optimum corrective action can be taken. For 
example, it is desirable to know the rate at which the tank pressure is 
increasing in relationship to the predicted values; it will be very desira- 
ble to establish trends. 

There are eight areas or conditions that are of interest: 

• Condition of the LF 2 tank 

© Existence of external hazards 

• Environment in the shroud 

• System failures (valves, Jmrst. disks, etc.) 

© Environment in the cargo bay 
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• Conditions during deployment of the spacecraft and 

IUS/TUG into orbit or during a deployment off-load 

mode 

• Status of the dump system 

• Status of safing mechanisms. 

For the above there are several parameters that must be monitored 
and some are more critical than others. The criticality of the parameters 
can be determined, in general, by reviewing the hazard analysis in 
Appendix 9. All the parameters that have an effect on orbiter and 
personnel safety will be listed below; as shown in the hazard analysis, 
some of the parameters monitored that indicate an imminent hazard exists 
or will exist are more likely to occur than others. For example, it is 
more likely that the allowable LF^ tank pressure will be exceeded if an 
extended mission occurs than that the Mariner spacecraft hydrazine tank 
pressure will be exceeded and cause a rupture which may damage the LF 2 tank. 

The parameters of the spacecraft which may be monitored are: 

• Condition of the LFg tank 

- LF 2 tank pressure (analog measurement} (essential) 

- LF 2 tank temperature (analog measurement) (essential) 

- F2 gas detection inside the outer LF 2 tank leak containment 
shell (analog signal desired so that the size of the leak 
can be determined). 

t System Malfunction (essential) 

- Indication of leakage of valves between the He tank 
and the LF 2 tank; could be caused by the launch 
environment. 1 

- Indication of burst disk failure. 

• Environment in the Shroud (desirable, not essential) 

- Pressure and temperature in the shroud 

- Gas detection in the shroud (analog measurement). 

Detector should ideally be able to discriminate 
between different types of oxidizers and fuels. 

Gas may leak into the shroud via plumbing or valves. 
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- Indication of leaking past valve seats and burst 
disks (e.g., isolation valve leak). 

- Inadvertent opening of valves by electrical control 
system. 

Not all of the above signals are considered essential. Caution 
and warning signals are to be handled in redundant pairs. For each signal 
pair, one is to be routed via hard lines and one by means of an interleaved 
encoded signal which is also telemetered to earth. From the above men- 
tioned signals the following are recommended as practical signals from the 
fluorine/oxidizer containment vessel /oxidizer containment system and are 
sufficient to identify credible hazards are shown in Table 4-18. 

Signal conditioning of the above parameters can include: 

1) Display parameters 

2) Caution (amberlight) signal if parameter exceeds 
nomina 1 condition by a percentage of limit conditions 

3) Warning (red light) signal if the parameter exceeds 
the nominal condition by a predetermined amount 
(limit condition) 

4) Rate of change of the above parameters. 

Voting logic could be employed in which a single temperature or 
pressure signal would not elicit a caution or warning unless confirmed by 
other signals. Alternatively, the mission payload specialist could decide. 

Implementation of the caution and warning system might be accom- 
plished with only a modest increase in spacecraft propulsion weight, if 
attachments are limited to transducers and a minimum of ancillary equip- 
ment. It appears that much, if not all, ancillary equipment might be 
mounted in the orbiter bay and conditioned proportional signals and/or 
caution and warning signals generated there. 

Other systems should be monitored for: 

• Existence of External Hazards 

- Detect leaking fuels 

- Other tank pressures in the Mariner spacecraft 
and IUS/TUG . 

- Temperature of RTG and other hazards on the RTG. 
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Table 4-18. Suggested Caution and Warning Instrumentation 


System 

Symbol Name Fg Caution Warning NgO^ Comment 


TOPC Temperature oxidizer 
propellant container 

POPC Pressure, oxidizer pro 
pell ant container 

SOPC Strain, oxidizer pro- 
pellant container 

MOXSS Leakage, oxidizer 
secondary shell 

PDKPF Pressure, dump kit 
peculiar Fg 


(1) 

and 

(2) 

-306 




+TBD°F 

(1) 

and 

(2) 

TBD 

(1) 

and 

(2) 

Equiv. to 




above 

(1) 

and 

(2) 

If detected 

(1) 

and 

(2) 

-1 psi 


(19 psia 
1.3 bar) 


i'V.P=300 Not required 
psi)* 21 bar 

e-g.300 psi (1) and (2) 
21 bar 

(where Pt - (1) and (2) 
300 psi )* 

If detected (1) and (2) 

-2 psi Not required 
(18 psia 
1.2 bar) 


Thermocouple or resis- 
tance thermometer 

Pressure gauge 


Optional alternate to 
POPC 

May be a discrete signal 
from a corrodible wire 

Normal pressure GN 2 at 
approximately 20 psia. 
Pressure indicates line 
intact 


MOXDF Leakage, oxidizer 

dump F 2 (if feasible) 


(1) and (2) If detected 


Not required In dump line, S/C propul- 
sion 


^Via hardline 
^Via encoding 

*Based on tank designed to operate at, say, 420 psi (23.6 bar) 


] 
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• Cargo bay 

- ?2 9 as detection in the area of the cargo bay. 

Detector should be able to discriminate between 
oxidizers. 

• During Deployment 

- Indications that all lines are adequately disconnected 
that could cause damage to the LF 2 system if the lines 
failed to disconnect. 

- Monitoring of LF 2 tank parameters required up to 
firing of IUS/TUG. Monitoring is to be switched 
from the hard lines to the RF system. 

- Monitor all payload tank pressures during all deploy- 
ment modes. 

- Indication of failure to remove the shroud 
properly. 

» Dump System 

- Monitor the F 2 dump system gas leak rate before 
dumping (analog monitoring probably required). 

si Safing of payload 

- Monitor all safing mechanisms to assure that the pay- 
load is in the proper condition at the proper time. 

- Assure that all valves are properly positioned. 

4.7.4 Imminent Danger 

Soma hazards present an imminent danger to the orbiter and to one 
or more of its crew. Some of the conditions that would be * cause of alarm 
and would require immediate corrective action would be: 

• If the LF 2 tank pressure increases above red line value 
during any phase of the mission 

• If a major leak (intermediate leak or greater) in the 
LF 2 tank was indicated during any phase of the mission 

• If a pressure vessel external to the LF? tank explosively 
ruptured or if any other external hazard comes into 
existence that would cause a major leak in the LF 2 tank. 

• If integrity of the dump system is lost (if it is needed). 
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• If payload cannot be removed from the cargo bay in 
allocated time scale plus time added for safety. 

4.7.5 Corrective Actions 

There are several corrective actions that can be taken by the crew 
once it is known that one of the hazards described in the hazard analysis 
exists, and which are determined to exist by an evaluation of the above 
parameters. For conditions where an imminent danger exists, the 
propellant should be dumped as soon as possible, except for the condi- 
tion where the dump system integrity is lost. If the dump system integrity 
is lost, other means of removal are to be used, either deployment or 
removal on the ground. 

For other conditions, the propellant should be dumped after orbit 
has been achieved. It is recommended that the orbiter not land with a pay- 
load containing LF 2 , if a dump system is available. Design should allow 
for normal landings. 


4-120 


( 

1 


4.8 TASK 9 - PRELAUNCH OPERATIONS SAFETY PROCEDURES 

4.8.1 Task Description 

The task statement is as follows: 

Describe the technical safety procedures during prelaunch 
operations which you believe must be followed in o'-der to gain 
approval to use LF 2 in the shuttle launched spacecraft. 

4.8.2 Prelaunch Technical Safety Procedures 

Shuttle and spacecraft 

In order to gain approval to use LF 2 in shuttle launched space- 
craft it is considered appropriate to implement a number of technical 
safety procedures. In order for these procedures to be fully meaningful, 
the ground and flight equipment with which they are used must be appro- 
priate. Spacecraft propulsion hardware considerations were discussed 
under Task 5 and hardware impact on the Shuttle and spacecraft are 
described in Task 10. The key to safe LF 2 operations is (1) the avoidance 
of contamination of the system, and (2) avoidance of significant leaks. 

Tasks 1 and 2 describe in considerable detail the suggested pre- 
cautions for prelaunch technical safety procedures. These are procedures 
that are considered to be necessary to achieve a very high degree of system 
safety. These procedures are, of necessity, in excess of those that 
would be required at, for example, a rocket test facility. The reason for 
this is that the facilities involved and the recovery time effects are 
much more severe in the KSC/Shuttle context than in less valuable 
facilities. 

Once the feasibility of fluorine propulsion is shown and questions 
regarding its stability and toxicity are satisfied, it is believed that 
approval for its use may be obtained. 

It will be necessary that a design approach such as described by 
JPL in Appendix 1 is used and a consistent set of safety procedures is 
implemented. 

This report provides one set of recormended procedures which could 

be used. 
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These recommendations include: (1) use of appropriate propellant 

handling procedures as described in Reference 1, (2) acceptance of the 
(over 70) appropriate criteria and assumptions described in Task 1, and 
(3) acceptance of the conclusions and recommendations of 11 tasks. It is 
acknowledged that these may not be the only set of criteria but they are 
believed to be an appropriate set. Some of the key points are: 

e Isolation of the oxidizers to their tanks while in transit, 
with no exposure of the oxidizer to lines and valves, except 
the tank isolation valves. 

• Design consistent with the best available knowledge, 
especially as to design and welding. An all -welded pro- 
pellant containment assembly is recommended and double 
wall construction may also be used. 

e A development program which is conducted without 
unresolved technical difficulties, so as to provide 
assurance of safety. 

t A safety development program which is instituted con- 
currently with the hardware development. 

s Appropriate propellant loading facilities are provided 
and dedicated through siting. Leak detection should be 
automated at the launch site. 

® Appropriate processing and procedures are instituted at 
the launch site and during flight. 

e Appropriate staffing and training are implemented, 
including a propellant safety crew from arrival of 
spacecraft on the pad until launch. 

« Appropriate accommodations are made in the Orbiter. 
Especially as to hazards from other systems. LN 2 
cooling of LF 2 should be provided until liftoff. Pro- 
pellant status instrumentation should be provided. 

® A dump system is to be considered if external hazards 
to the LF 2 or N 2 O 4 tanks from other systems in the 
cargo bay are credible. 

An expanded list of the appropriate criteria are included as Table 4-19. 
This table contains criteria which summarize this comprehensive safety 
program. Additional detail is contained in the various task sections 
of this report. 
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Table 4-19. Recommended Propellant System Safety Criteria 
and F 2 Propellants 


APPLICABLE TO 
LF 2 ^2^4 


GENERAL 


1. No planned leaks or uncontrolled vents to atmosphere. See 
Tasks 1 and 2. 

2. Reactive propellants should be separated whenever feasible. 

3. Failures of single system valves and controls shall not result 
in oxidizer tank failure. 

4. Pressurized tanks shall not fragment in the event of failure 
{design to leak or vent before structural failure). 

5. Isolation of the oxidizers to their tanks while in transit. 

6. Design consistent with the best available knowledge, expecially 
as to design and welding. An all welded propellant containment 
assembly is recommended and double wall construction may also 
be used. 

7. A propulsion development program which is conducted without 
unresolved technical difficulties, so as to provide assurance 
of safety. 

8. A safety development program is instituted concurrently with 
the hardware development. 

9. Appropriate propellant loading facilities are provided and 
dedicated through siteing. 

10. Leak detection should be automated at the launch site with 
an alarm system. See Task 4. 

11. Appropriate processing and procedures are instituted at the 
launch site and during flight. 

12. Appropriate staffing and training are implemented including a 
propellant safety crew from arrival of S/C on the pad until 
launch. See Tasks 2, 8. 

13. Ancillary systems shall be designed so as to preclude single 
failure malfunctions which could result in release of oxidizer 

14. Propellant leaks shall be individually contained or controlled 
so as to prevent mixing of fuels and oxidizers with the 
resulting possibility of fire or explosion. (This means all 
combinations of all propellants in or around the orbiter. 

15. Launch processing development without unresloved incident. 


X X 


X X 

X X 

X X 


X X 

X 


X 


X X 

X X 

X X 


X X 

X X 


X X 

X X 


X 
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Table 4-19. 


Recommended Propellant System Safety Criteria 
and F 2 Propellants (Continued) 


PREFLIGHT 


16. Ground crews shall not be required to be exposed to propellants X 

during filling or draining of the propellants. 

17. Each item of GSE shall have been acceptance tested, passivated X 

and demonstrated with propellant prior to first use with a 

spacecraft propulsion system to double check its function 
in a low risk environment and verify personnel training. 

18. Fluid lines shall be purged and empty of propellants before X 

disconnection from the loading equipment. 

19. All pneumatic and/or hydraulic interface connectors shall be X 

pressure checked after mating. 

20. Remote loading in suitable facility and transfer of loaded X 

spacecraft to pad for insertion within cargo bay - See tasks 

1 and 2. 

21. Load under favorable weather - See tasks 1 and 2 (daily opportunity). X 


22. Clear launch pad of unnecessary personnel when oxidizers are X 

moved - wear SCAPE suits - See task 4. 

23. Time limit on holds. See Task 3. X 

24. Fully developed "backout" procedures - ground and flight - See X 

Task 9. 

25. Loading of oxidizers will be done remotely from the launch pad X 

in a dedicated facility sited for oxidizer toxicity. 

26. The spacecraft (S/C) propulsion system shall be replaceable/ X 

removeable on the launch pad without compromising the safety 

of the associated systems, together with the S/C. 

BOOST AND DEPLOY 

27. Restricting of oxidizer to a "Propellant Containment Assembly" X 


with no exposure of oxidizer to propellant lines during propellant 
loading, payload processing or launch. - See Task 5. 

28. Extreme cleanliness & hardware passivation - See Task 9. X 


X 

X 


X 

X 

X 


X 


X 

X 

X 


X 


X 


29. No (or very low) pressurization of the Propellant Containment X Low Pressure 

Assembly until after deployment from the orbiter and performance Blanket O.K. 

of a back-off maneuver - See Task 5. 


30. Use of emeraency dump nrnppi lant "lines cc n nected from the space X X 

craft propulsion to the orbiter - See Task 5. 
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Table 4-19. Recommended Propellant System Safety Criteria 
and F 2 Propellants (Continued) 


31. 

Use of a redundant or secondary propellant containment shell 

Opt. 

May not 


which may also serve other functions such as a vapor detection 

or 

be re- 


cavity - See Task 5. 

TBD 

qui red 

32. 

An in-flight vapor detection device - See Task 8. 

Desire- 

able 

* Desire 
able' 

33. 

Caution and warning signals to be generated from a combination 
of pressure, temperature and vapor detection instrumentation - 
See Task 8. 

X 

X 

34. 

Adequate Margin on time to deploy from disconnect of GSE OL, 
E.G., externally regulated system - See Task 3. ^ 

X 


35. 

Critical systems hazardous to the orbiter in the event of 
malfunction will not be activiated until there is adequate 
separation between the spacecraft propulsion and the orbiter. 
e.g. electrical power to the spacecraft propulsion shall be. 
interlocked. 

X 

X 

36. 

Propellant status ana perhaps leak detection monitors shall be 
provided from installation of propellants in the orbiter through 
deployment. 

X 

X 

37. If propellant dump capability is provided, it shall be operational 
during these phases insofar as possible. 

RECOVERY AND ENTRY 

X 

X 

38. 

Propellant tanks shall be located where they are not exposed 
to damage during operations. 

X 

X 

39. 

Propellant monitors shall be operational during recovery 
operations for use in abort unless dump capability is provided 
in which case they may be optional, 

X 

X 

40. 

In flight propellant conditioning method shall be passive or 
double malfunction safe or alternate system provided. 

V 

A 

X 

41. 

Spacecraft propulsion shall be designed to survive and/or 
minimize damage in the event of a crash landing. If a dump 
capability is not provided, design requirements of the propul- 
sion system should include capability to withstand of crash 
loads per JSC 07700. 

X 

X 

42. 

Sloshing of residual propellant shall not result in a hazard 
to the orbiter under any flight or landing conditions including 
crash landings. 

X 

X 

43. 

Propellants shall not be dumped under condition which will adversely 
affect the Orbiter, i.e, during re-entry. 

X 

X 

44. 

Tanks shall be capable of maintaining positive pressurization in 
order to ensure return to earth without tank collapse (crushing), 
or abla to withstand outside pressure. 

X 

X 
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Table 4-19. Recommended Propellant System Safety Criteria 
and Propellants (Continued) 

45. Removal of propulsion from the orbiter will on\y he accomplished 
with tanks empty and purged. 

46. Ventilation purge of the intra-shroud area should be used as a 
precaution prior to de- tanking. 


POSTFLIGHT 


47. The safing system shall not expose crews to ha'ardous materials 
unless protective clothing is required, even Plough a dump 
capability is provided. 

48. Remote monitor and control of propellant systems shall be provided 
during the safing operation. 

49. Procedures for decontamination and refurbushment shall be provided 
to provide for reuse of hardware after an aborted mission, 
(preferably on a minimum duration turnaround.). 


It can be seen from this list that the recommended precautions are 
somewhat more stringent for LF 2 than for N 2 0^. The reason for this is that: 
(1) no consensus yet exists which equates LF 2 to N 2 G^ in safety, therefore 
greater caution will be mandated by NASA in its use until it is flight 
proven, (2) safety precedents have not yet been established for other 
shuttle launched propulsion systems such as hydrazine systems and the OMS 
kits, and (3) there is no experience base which shows that the other 
Shuctle cargo bay elements will not cause hazards (damage) to the fluorine 
propulsion system. If this third item were not the case, use of double 
walled propellant tanks and dump systems might not be recommended. 

It is recommended that prior to commitment to a system development 
for flight hardware that the dcuble wall tank and dump system decision be 
reviewed. For technology work and program planning it appears advisable 
to carry them as tentative requirements. Also, design of the orbiter 
should leave room to add the dump lines. 


t 

I 


I 

I 





4.9 TASK 10 - SHUTTLE AND SPACECRAFT 

4.9.1 Task Description 

The task statement is: 

Describe the impacts of the procedures of Task 9 on the 
Shuttle and on the spacecraft in terms of required hard- 
ware, mating procedi'i'es , shroud design and operational 
timelines. Identify the spacecraft hardware and ground 
support equipment that is unique to the use of fluorine 
as a spacecraft propulsion fluid. Determine the effects, 
if any of the RTG and the shroud on the results of the 
study. 

4.9.2 Evaluation of Shuttle Payload Accommodations/RTG/Shroud 

4.9. 2.1 Space Shuttle Accommodations 

There is little impact on the Shuttle in terms of hardware because 
of prelaunch operations safety procedures, a design study is needed. The 
main impacts are those of: 

(1) The LNp cooling line which may be approximately a 
1/2-inch insulated line. This line should be routed 
through the T-0 umbilical and through to the spacecraft 
IUS/TUG interface with a highly reliable disconnect 
device. 

(2) The propellant dump line which is approximately a 
1-1/2 inch line, must be routed through the space- 
craft - I US/Tug interface. 

(3) An oxidizer relief line is also needed. 

4.9. 2. 2 Ground Support Equipment* 

Ground support equipment unique to fluorine includes: 

(1) The propellant transport truck which might also be 
used as an emergency drain tank 

(.2) Fluorine specific yapor detector (this presumes 
that there is a safety console at loading and 
launch sites) 

C3) LN 2 coolant reservoir and related equipment 

(4) Fluorine compatible SCAPE suites, see Appendix A 


*Also referred to as GSE, AGE, or OSE. 
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(5) Insulated lines to connect between propellant 
transport truck and propulsion system 

(6) Hand-held propellant vapor detection units unless 
this is a launch site supplied item not GSE. 

Other items such as TV monitors, permanently installed vapor detectors, 
and safety console are included under section on Task 4. 

4. 9. 2. 3 Hating Procedures and RTG Installation 

As described in Tasks 1 and 2 Processing Option 3 was selected as 
most efficient and simple, consistent with safety of personnel, equipment 
and facilities. This approach anticipates insertion of the spacecraft 
into the Space Shuttle and mating with the IUS/TUG interface inside the 
cargo bay. A general description of how the spacecraft is transported 
from the storage site to the PCF is contained in the hazard analysis. The 
mating operation will consist of: 

• Move the PCF up to the Shuttle Orbiter 

• Open Shuttle cargo bay doors 

• Prepare IUS/TUG interface for mating 

• Verify same 

« Prepare Spacecraft interface for mating 

• Verify same 

• Clear pad of unnecessary personnel 

• Disconnect LN 2 cooling lines from spacecraft 

■ Position Spacecraft vis-a-vis IUS/TUG and connect 
s Verify physical and electrical compatibility 

• Verify ground readout of propellant status 

• Within approximately TBD hours from step 7, the LN 2 
must be reconnected to the spacecraft, and cooling 
initiated 

• Passivate the dump line 
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9 Sound all clear. Personnel may resume work on other 
systems. Although work on nearly all systems should 
have been performed prior to this sequence. No visitors 
or unnecessary personnel should be allowed on the pad 
from this time until launch. 

• The RTGs should next be installed 

e Close doors 

t Roll back PCF 

• Launch. 

4. 9. 2. 4 Operational Timelines 

The launch timeline is shown in Figures 4-9a and 4-9b. Either pro- 
pellant affects the timeline. Time required for LF 2 is slightly longer 
because of additional pad clear time, LNg connection time and time to 
passivate the dump line. 

4.9. 2. 5 Shroud Design 

The design as described by JPL anticipates no penetrations of the 
shroud except for the RTG. The only design impact on the shroud is the 
desirability to make the shroud compatible with leaks. If it is aluminum 
it should be compatible. Some consideration has been given to making the 
shroud a third level vapor containment shell for fluorine. Feasibility of 
this ap oach could not be evaluated in this program and so the secondary 
tank shell is suggested. For N 2 0^, use of the shroud as a vapor barrier 
may be practical provided all materials contained therein can be nonflam- 
mable with N 2 0^. 
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4. 10 TASK 11 - COMPARISON WITH GDC BNZ-69-013-9 


4.10.1 Task Statement 

The statement of this task is: 

Compare the results obtained from Tasks 1 through 10 above 
with the results presented in Reference G and identify 
portions of that study which appear to be affected. 

4.10.2 Comparison Made 

The results of this General Dynamics Convair Division Report 

prepared on Contract NAS7-742 were summarized as follows: 

SUMMARY 

Under the guidance of JPL and using inputs from AFETR/ 

KSC launch operations personnel, Convair has documented 
the feasibility of pre launch operations with a Space 
Storable Propulsion Module. 

In spite of their toxic, reactive, and cryogenic prop- 
erties, oxygen di fluoride (OFo) and diborane (B 2 H 6 ) or 
FLOX/methane propellants can be safely used. The 
3,000 pounds of propellant, typical for retro propulsion 
on unmanned outer planet orbiters, can be handled in 
the same flow sequence successfully used for Surveyor 
and Mariner. Convair reconmends this proven operating 
plan of tanking in the Explosive Safe Facility Propel- 
lant Lab about 30 days before launch because this 
allows excellent checkouts for maximum assurance of 
mission success. 

Personnel safety can be assured by a number of reasonable 
precautions. Toxic waste from routine blowdowns during 
tanking and draining should be neutralized or burned. 

In case of propellant module leakage, emergency drain 
provisions are recommended using the supply trailers as 
receivers. Passivation techniques, including 24 hours 
at full pressure propellant vapor, have been demon- 
strated. Thermal control based on a simple ground-based 
LN 2 system can assure indefinite standby without venting. 
During propellant passivation, transfer, and pressuri- 
zation (allowing for the worst case of a rapid cold 
release of all the oxidizer), reasonable weather restric- 
tions and evacuation radii would be imposed, as is done 
with the Titan booster. Once the module has been 
remotely loaded, pairs of technicians can work around the 
spacecraft wearing splash type suits. Handling a loaded 
propellant module can be routine for a well -trained crew 
using careful procedures. Operational support equipment 
can be simple and dependable. 
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The Mission Program Office may elect to tank at the 
launch complex (which is the current Centaur practice) 
for maximum personnel safety. The period of greatest 
hazard is during passivation, propellant transfer, and 
pressurization. Once these dynamic conditions cease, 
the risk to personnel and hardware decreases progres- 
sively as the system remains in a quiescent state. Convair 
recommends tanking the module once before encapsulation, 
even though the unit may then be drained and final tanked 
at the launch pad, in order to minimize the risk to the 
expensive payload. 

Prelaunch operations can have a significant influence on 
the flight vehicle design. An access door should be 
provided in the aerodynamic shroud for installation of 
the radioisotope thermoelectric generator (RTG) and 
manual access to drain and/or vent the propulsion module. 
This will minimize the spacecraft launch and in-flight 
disconnects, which reduce reliability. Accurate propel- 
lant weighing is required. Quick demating of an encapsu- 
lated spacecraft is recommended. The arrangement of the 
propulsion module valving is dependent on passivation, 
purge, checkout, and leakage requirements. As the pro- 
pulsion system becomes better defined, test techniques 
and prelaunch checkout methods must be evolved and 
capabilities built into the design to maximize chances 
of mission success. 

Prelaunch operations using FLOX/methane are inherently 
similar to those with 0F2/B2H6- The fact that methane 
is not toxic is of little benefit because handling 
restrictions are determined by the oxidizers. The 
differential boil off of FLOX will force the use of more 
complicated LN 2 jacketed lines and mixing and composi- 
tion sensing equipment. Similar thermal control tech- 
niques are applicable to both propellant combinations. 
Differences in prelaunch operations are more likely to 
result from airborne design features such as thin- 
walled tanks with the pimp-fed propulsion systems 
normally considered with FLOX-methane. 

Follow-on studies are suggested in several areas. 

Perhaps the greatest challenge is the development of 
really leak-tight propellant shutoff valves and 
reasonable checkout tests to assure that these valves 
will function after a 550-day space flight. Thermal 
insulation systems must be compatible with minute 
propellant vapor leaks. New hazard sensing instru- 
ments for remote, selective indications would be useful 
on current programs. Toxicity studies should be 
completed to loosen the extremely tight, currently 
accepted exposure limits on OF 2 . 
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This study has not uncovered any major technology road 
blocks, but rather indicates that prelaunch operations 
will not restrict the development of a space-storable 
propulsion module. 

In that study, 3,000 pounds of propellant was considered typical 
rather than the maximum as is considered in this study. This difference 
may be due to the difference between the Titan booster considered and the 
use of the Space Shuttle. 

It is believed that routine blowdowns during tanking and draining 
are undesirable activities and that, if possible the tank should be filled 
only once. Emergency drain using supply trailers is considered appropriate. 
More sophisticated passivation techniques including thermal monitoring 
are suggested. Weather restrictions are appropriate, as is done with the 
Titan booster. Remote loading is presumed. Technicians may then work 
around the spacecraft, however, fluorine SCAPE suits are recommended 
rather than just splash suits. 

Propellant loading is not expected to be allowed at the launch 
complex due to the very high investment in facilities at that location. 

It is concluded that it is safer to personnel as well as equipment and 
facilities to load the tanks remotely. 

It is agreed that the greatest likelihood of accidental escape of 
fluorine is during passivation, propellant transfer (because of the large 
number of components in the GSE and temporary lines) and pressurization. 

For these reasons it is recommended to load remotely from the pad and to 
avoid pressurization all together. 

The Convair study anticipated boil off of FLOX and resulting differ- 
ential loss of ?2 ant * ^2* ^ith suggested system described in Task 5, 
no boil off is allowed. This is the procedure followed in fluorine ground 
transport operations. 

The follow-on work as suggested in the Convair study considered 
valving, thermal insulation compatible with minute leaks, hazard sensing 
instruments and toxicity studies related to OFg. 
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TRW would suggest that at the present time, the mission spectrum 
and its constraints are well enough defined, and for pure liquid fluorine, 
technology has advanced to the point that an integrated component program 
can begin. Appropriate areas include advanced development on flight pro- 
pulsions systems containing 500-3,000 pounds of fluorine and having 
engines in the 200-800 pound thrust class. 

It is believed that the key areas of technology include: 

(1) Exact definition of propellant containment material 
for long flight life {compatibility suitable for safe 
launching has already been established). 

(2) Valve technology for leak tight propellant containment 

(3) Demonstration of flight engine performance, duration 
and weight 

(4) Demonstration of a flight type propellant containment assembly in 
such a manner as to promote safety assurance is considered especially 
appropriate at this time. 

Spill testing of 0F 2 is, of course, not appropriate to the LFg 

system. 


Table 4-2Q summari zes the detailed comparison of conclusions, 
recommendations and suggested follow-on tasks of the Convair report. 

Four other aspects of design warrant additional investigation, 
they are: 

(1) Dump line — A dump line could be needed in case the 
tank is known to be leaking or in ca‘e of a fire. 
Basically the dump line is only needed during the 
ascent phase when the cargo bay doors are closed. 

If a dump line is used, it is a source of consider- 
able expense, and it is a potential source of 
hazards . 

(2) Vent/relief — A vent/relief is needed primarily 
during deployment phase after the dump line is 
disconnected and before separation from the Shuttle. 

(3) Catch pan — A catch pan under the oxidizer tank has 
been considered; however, it would be difficult to 
implement because of the need for cleanliness. Also 
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Table 4-20. 

TASK 11 

COMPARISON OF RESULTS WITH GDC BNZ 69-013-8 
FINAL REPORT CONTRACT NAS7-472 


RESULT, CONTRACT NAS7-472 
CONCLUSIONS 

1 . BETTER FUNCTIONAL AND LEAK CHECKS 
IN ESF 

2. PROPELLANT FLOW IS GREATEST 
HAZARD 

3. MINIMUM PERSONNEL HAZARD DUE TO 
LOADING ON PAD 

4. MINIMUM OPERATIONAL RESTRICTIONS 

5. 0F 2 TOXICITY LIMITS TIGHT 

6. SIMPLE OSE REQUIRED 

7. EXCELLENT TANK SAFETY 

( ; 

RECOMMENDATIONS 

1 . RECOMMEND ESF TANKING 

2. FACILITY AND PROCEDURE VALI- 
DATION 

3. INITIAL LOADING 

4. MINIMUM INFLIGHT DISCONNECTS 

5. ACCESS DOOR 

6. HAZARD SENSING IN THE PROPULSION 
MODULE 

7. EMERGENCY DRAIN 


I \ 

• n 


COMMENT BASED ON THIS STUDY 


CONCUR ON REMOTE LOADING 


GREATEST HAZARD TO PROPULSION SYSTEM 
MOST LIKELY TIME FOR HAZARD EVENT - 
CONCUR 

NOT APPROPRIATE FOR MANNED SHUTTLE 
SYSTEM 

24 HOUR RESTRICTION OF PAD MAY NOT 
BE APPROPRIATE, 9 HOUR COMPROMISE 
OF TIME-LINE APPROPRIATE 

OF? LIMITS ARE MORE RESTRICTIVE 
THAN FOR LF 2 

GENERALLY SIMILAR 

PRESSURE SAFETY MARGIN IS OF SECON- 
DARY IMPORTANCE COMPARED TO CON- 
STRUCTION SUITABLE FOR LF g SERVICE 


A MODIFIED ESA-60 MAY NOT BE AC- 
CEPTABLE TO ALL CONCERNED (BUT 
APPEARS REASONABLE) 

CONCUR 

CONCUR 

SYSTEMS DIFFER 
SYSTEMS DIFFER 
GENERALLY SIMILAR 


CONCUR 
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Table 4-20. 

TASK 11 

COMPARISON OF RESULTS WITH GDC BNZ 69-013-8 (CONTINUED) 
FINAL REPORT CONTRACT NAS7-472 


RESULT, CONTRACT NAS 7-472 
SUGGESTED FOLLOW-ON TASKS 

1. TOXICITY STUDIES - 0F £ 

2. SENSOR DEVELOPMENT 

3. DIFFUSION STUDIES 

4. INSULATION COMPATIBILITY 

5. STUDY OF DIBORANE FREEZING 

6. HISTORY OF PRELAUNCH PROPELLANT 
PROBLEMS 

7. DEVELOP LEAK TIGHT VALVES 

8. STUDY WEIGHING TECHNIQUES 


COMMENT BASED ON THIS STUDY 

TOXICITY STUDIES OF LF« MAY BE 
APPROPRIATE * 

SENSOR DEVELOPMENT APPROPRIATE FOR 

lf 2 and n 2 o 4 

ADDITIONAL DATA WOULD BE BENEFICIAL 
BUT CONSIDERABLE WORK HAS BEEN DONE 

FOAM INSULATION SHOULD BE TESTED 

NOT APPLICABLE 

CONCUR 

STRONGLY AGREE 
OF SECONDARY IMPORTANCE 
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it must penetrate the shroud. It would only be 
functional in the PCF and in the cargo bsy prior 
to launch. It is not known if such a device is 
technically feasible. The likelihood of it being 
needed appears remote. Further investigation is 
needed. 

(4) Double wall tank — A secondary shell could provide 
additional leak containment and some protection 
against external hazards. It is an additional 
expense and adds weight to the spacecraft. 

While it is difficult to argue with the desirability of being able 
to mitigate effects of leaks, each of these tends to create other hazards 
which tempt the designer to make a simple clean design and rely on its 
inherent safety. 
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4.11 TASK 12 - FLIGHT HAZARD ANALYSIS 
4.11.1 Task Statement 


The task s'^tement is: 

Include a flight hazard analysis. 

This task was to include a flight hazards analysis in this report. 
Since it relates so closely to Task 6 Oxidizer Dump System, the flight 
hazard analysis is included in that section (Section 4.5). The tabular form 
appears in Appendix 9. 


4.12 FEASIBILITY ASSESSMENT AND CONCLUSION 


4.12.1 Task Description 

Task 7 requirements are as follows: 

Assess the feasibility of using fluorinated oxidizers for 
a Shuttle launched spacecraft in terms of personnel safety 
and the requirements developed under tasks 3, 4, 5 and 6 
above (e.g., temperature control, leak detection and con- 
trol, system comparison and oxidizer dump system). 

4.12.2 Statement of the Reasoning and Feasibility of Using Fluorinated 

Oxidizers 

Bases of Comparison and Definition of Feasibility 

The purpose of this study has been to compare safety interfaces 
between the Shuttle and spacecraft and identify new or unique propulsion 
system requirements that would result from the use of liquid fluorine in 
the propulsion system of a planetary spacecraft launched from the 
Space Transportation System or Shuttle. 

The oxidizer was taken as a point of reference because it 
also is a toxic, highly corrosive, hypergolic propellant.* When it is used 
with MMH, it represents a widely accepted propellant. If it were not an 
accepted propellant, it would not be used in the Shuttle Orbit Maneuvering 
System or reaction Control System or be considered an acceptable Shuttle 
cargo as in the OMS Propellant Kits, It can only be concluded that use of 
NgO^ is considered feasible. 

If it can be demonstrated that propellants other than NgO^ are 
desirable, and that there are suitable techniques which can be used result- 
ing in equai safety, then that propellant must also be feasible. 

The term feasibility as used in the aerospace industry may be con- 
sidered to mean whether it is practical or whether within the present 
state of the art something can be done at all. It appears clear from the 
task description that the first definition (which is the dictionary defi- 
nition), practicability, is meant. Feasibility or practicability for this 
study must mean whether fluorine can be practically used within reasonable 
economic constraints. For it to be practicable it must be useful, economi- 
cal, technically feasible, and safe. 

and is to be used on other payload, and in the Orbiter itself. 
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f. ■ ; ] 

?'■ i i 

Performance and economic analyses performed by JPL indicate the 
' economic desirability of LF 2 propulsion. There are a number of missions of 

l great interest which involve the orbiting of Mariner (and also Pioneer) 

■■ class spacecraft around the outer planets. In order to do this consistent 

f with anticipated Shuttle Upper Stages (SUS) and with reasonable flight 

times, it has been found most effective in many cases to utilize the high 
level of propulsion performance that can only be obtained with fluorine 
containing oxidizers such as liquid fluorine or fluorine oxygen mixtures. 

The cost of developing the F 2 propulsion system is less than the 
cost of a single Shuttle flight (which is approximately 10 million dollars 
for the flight), while the overall cost of performing a mission is many 
l times the cost for a Shuttle flight. For some Mariner missions, LF 2 can 

carry twice the payload, and in many cases more than double it. For some j 

missions, it can save the cost and technical risk inherent in a weight j 

reduction program for the spacecraft. It appears possible then, to save j 

more than the entire development cost in a single mission. . j 

( ) In spite of the safety procedures, design constraints, hardware j 

impacts, and suggested modifications defined in this study, it appears that j 

the economic impact of safety will be a minor (relative to total program j 

\ cost), although necessary, addition to the spacecraft propulsion program for \ i\ 

its first use and will be altogether negligible for subsequent users. j 

4.12.2.2 Propulsion Feasibility j 

The propellant combination liquid fluorine and neat, unmixed hydra- 
zine (LFg/NgH^) has been selected by JPL for planetary orbiter work. This j 

combination has the advantage that it can draw on a large existing tech- j 

nology base from the chemical industry and, in the case of hydrazine, a ■ ] 

large amount of flight history from military and NASA flight programs. j 

Significant, perhaps extensive progress has been made towards the type of , . | 

propulsion needed for this application. Numerous programs have been spon- j 

:• sored by NASA involving many aspects of fluorine rocketry. The Department j 

of Defense has also sponsored extensive work in fluorine rocketry. Vj 
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4.12.2.3 Testing and Ground Operations 

As described in Appendix I JPL has conducted hot firing tests on a 
prototype self-contained (but not flight weight) propulsion system. Suc- 
cessful safe demonstration of such a system is prima facie evidence of tech- 
nical proficiency in those systems listed. No unexplained difficulties were 
experienced. 

As a result of these related efforts, in which many millions of 
dollars have been invested, there can be little question that the technical 
feasibility of fluorine propulsion has been demonstrated. 

That ground handling of LFg is feasible is an opinion in agreement 
with the viewpoint of many in the propulsion community. In regard to ground 
handling, there are several reports, see Table 4-21, by major propulsion 
contractors attesting to the feasibility of ground operations with propel- 
lant loads (weight of fluorine) greatly in excess of those stated, up to 
20,000 pounds. For typical 1000 to 3000-pound propellant loads, this study 
must certainly agree. 

The last item in Table 4-21 is particularly relevant considering 
the extensive experience with large amounts of NgO^ at AFETR and that the 
Emergency Exposure Limit for LFg is only a factor of two lower than that of 
NgO^, and the quantity is less than 2 percent of that of NgO^ in the Titan 
booster, or 20 percent of that in the 0MS kits. 

It is therefore concludcu that use of LFg is considered feasible 
for ground transportation and for ground handling at rocket launch sites. 

4.12.2.4 Shuttle Transportation 

No technical reason was found which might exclude transportation in 
the Shuttle except if other systems are so unreliable as to damage the 
fluorine container. The added precautions of double wall tankage and a 
workable dump system are believed technically feasible precautions which, 
if considered necessary, can be used to increase confidence that the system 
will be safe. (Details of Fg disposal after abort modes require definition) 

Ample heat-up margin can be designed into the thermal design of the 
spacecraft or supplied by auxiliary cooling systems. 
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TABLE 4-21. 


LF ? bSOUND HAt'iOLING-FEASIBlLi FY REFERENCES 
CONTRACTOR CONDUCTED 

REPORT NO. RE FERENCE SOURCE FOR • PR OPELLANTS BOOSTER SITE DATE 


COMMENT 



AFRPL-TR- Orbit to Orbit Shuttle General 
71-11.7 Propellant Integration Dynamics 
and Handling Study 


AFRPL 20,000 lb Space WTR 

Shuttle 

"005" 


1971 "These types of precautions 

should make fluorine vehicles 
operationally feasible. " (in 
the Shuttle, ed. ) 


NASw-28 Launch Area Ser- Bell 

Task vicing of a Fluorine Aero- 

/Hydrogen Upper Stage systems 


2 2 “Titlas AFETR Dec. Recommends . .operational 
7000 lb Centaur 1960 procedures? and* equipment to 

safely and reliably maintain a 
fluorine-hydrogen upper stage , 
through all prelaunch operations 


NASA , LF 7 Nike 1970 LF ? was* evi dentally safely 

Langley ,p,g Toma- handled and Flown 

3 0 hawk 

MAS7-742 Prelaunch Operations General JPL, 0F ? /B ? H R Titan AFETR/ May "Convair has documented the 

For a Space Storable Dynamics/ NASA ^nno ih .Centaur' KSC 1970 feasibility of pre-launch 

Propellant Module Convair OART ■■ LG-41 operations with a Space Storable 

Ref 15 (with inputs Propulsion Module." *• 

from Rocket- 

dyne) .. - - ' 


MAS 10- 

Launch Operations 

Martin- 

3-15,000 Delta, 

August 

’"The system developed is econo- 

7704 

with Upper Stages 
containing Fluorine 
Ref 16 

marietta 

lb of LF 9 LC-17 
L Titan 
Centaur, 
LC-41 
Space 
Shuttle 
LC-39 

1972 

mical , flexible and relatively 
safe." Launch operations with 
upper stages containing fluorine 
could be conducted with less 
hazard than those associated 
with launching boosters using 
storable propellants. 


4.12-2.5 Conclusions as to Feasibility of Using Fluorinated Oxidizers in 
Shuttle Launched Spacecraft 

The result of the study is that the safety interfaces have been 
compared considering crew and hardware when using the NgO^ and LF 2 and new 

and unique propulsion system requirements have been identified which would 
result from the use of liquid fluorine as an oxidizer in Shuttle Launched 
Spacecraft. 

The study utilized system safety engineering methodology to investi- 
gate potential hazards and system design engineering to define how existing 
technology could be used to provide safe operations. 

Feasibility of safe operation was investigated and the unique 
equipment and procedures necessary to maximize the probability of success 
determined. Hazards are similar in kind if not in degree to those encountered 
in use of nitrogen tetroxide (also a toxic oxidizer) in the Shuttle. 

It was concluded that residual risks from spacecraft using fluorine 
and nitrogen tetroxide oxidizers during ground and flight handling may 
be reduced by isolation of the oxidizer to only its tank. Operation of 
spacecraft propulsion in the vicinity of the shuttle or launch site is 
not required. Proper recognition of the characteristics of both oxidizers 
must be given in spacecraft design and in ground and flight operations. 

The primary hazard to personnel was identified as propellant loading 
operations which are very similar in nature to routine transfers from the 
truck trailers used during delivery of fluorine to industrial users. These 
operations should be accomplished in an area reasonably remote from 
personnel and facilities concentrations. 

Other important potential hazard is related to the transportation 
and installation of the loaded propulsion system, where great care must 
be exercised. 

Because of the relatively small quantity of LFg that would typically 
be used, 1000 pounds, toxicity is expected to be less of a difficulty 
than the other properties. This is borne out by the extensive and routine 
use and transportation by highway of up to 5000 pounds of liquid fluorine 
around the United States in trailer trucks. Reference 1 indicates a 2:1 
ratio of toxicity of fluorine compared to NgO^ on the basis of Emergency 
Exposure Limits. 
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From the study results it is believed that the necessary technology 
is available and with a systematic approach based on system safety engineer- 
ing, a suitable system can be developed, provided that the precautions 
described in this report are followed. Study results and these precautions 
are summarized in the following section. 

Due to the value and manned aspects and reusability of Shuttle 
Orbiter operations, significant safety precautions appear, indicated. : In - 
response to this need, compromises of the spacecraft propulsion to achieve 
safety have been considered which appear to be acceptable in terms of per- 
formance and cost. 

The safety interfaces when using either LFg or NgO^ are very similar 
and differ mainly in degree rather than kind, with the exception that 
fluorine must be treated as a cryogenic as well as a hypergolic. 

It is believed that the unique propulsion system requirements 
which would or should result from the use of fluorine derived from two 
characteristics of fluorine, its cryogenic storage and its high reactivity 
with fuels. 

The primary hazard to personnel was identified as propellant load- 
ing operations which are very similar in nature to routine transfers from 
the normal truck trailers used to transport fluorine to industrial users. 

It is suggested that these operations be done in an area reasonably remote 
from personnel and facilities concentrations. High safety factors are 
available in tankage in all operations. 

The next most important potential hazards relate to transportation 
and installation of the loaded propulsion system. Such operations can 
undoubtedly be made safer than in similar transportation of the chemical 
on the nations highways. 

Residual hazards during flight in the Shuttle Payload Bay from a 
propulsion system which has been loaded, stored, transported and installed 
appear low provided that external hazards to the propulsion system from 
other systems also in the cargo bay are minimized. 
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Even with the flight equipment suggested, including dump capability 
for both LF 2 and N 2 0. 4 and double walled tanks for LF 2 (leak-tight shroud 
for NgO^)* some residual hazards exist for both LF 2 and NgO^. The overall 
rationale for acceptance of these risks is that: 

1 ) The risk likelihood for N 2 O 4 initiated accidents is 
comparable to and lower than for other payloads, 
especially the OMS Kits. 

2) The chance of occurrence can be made remote. 

The suggested approach to safety development of using development 
experience as a basis for assurance is somewhat novel in its systematiza- 
tion but has many well established precedents. For example, development 
and flight experience of the Titan II missile became part of the safety 
justification for the highly successful NASA Gemini flights. 

4.12.2.7 Feasibility Investigation 

For the use of the propellant combination LFg/NgH^ for Shuttle- 
launched craft containing up to 3000 pounds of LFg, it appears that hardware, 
facilities and procedures can be developed to attain maximum probability of 
reasonable personnel safety, provided that proper emphasis is placed on 
safety and the procedures listed in the report or their equivalent are 
implemented. 

These recommendations are numerous and include (1) use of appropri- 
ate propellant handling procedures as described in Reference 1, (2) accept- 
ance of the (over 70) appropriate criteria and assumptions described in 
Task 1 , and acceptance of the conclusions and recommendations of the 11 
tasks (see the summary in Task 9). It is acknowledged that these may not 
be the only set of criteria but they are believed to be an appropriate set. 
Some of the key points are: 

.1) Isolation of the oxidizers to their tanks while in 
transit. 
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2) Design consistent with the best available knowledge, 
especially as to design and welding. An all welded 
propellant containment assembly is recommended and 
double wall construction may also be used. 

3) A development program which is conducted without unre- 
solved technical difficulties, so as to provide 
assurance of safety. 

4) A safety development program which is instituted con- 
currently with the hardware development. 

5) Appropriate propellant loading facilities are provided 
and dedicated through siting. Leak detection should 
be automated at the launch site. 

6) Appropriate processing and procedures are instituted 
at the launch site and during flight. 

7) Appropriate staffing and training are implemented, 
including a propellant safety crew from arrival of 
spacecraft on the pad until launch. 

8) Appropriate accommodations are made in the Orbiter, 
especially as to hazards from other systems. LN ? 
cooling of LF2 should be provided until liftoff/ 

Propellant status instrumentation should be provided. 

9) A dump system is to be considered if external hazards 
to the LF2 or N2O4 tanks from other systems in the 
cargo bay are possible. 

In Tasks 1 and 2, the study produced clear conclusions that (1) auto- 
matic leak detection' at the pad is desirable, and (2) propellant should not 
be loaded into the spacecraft at the pad, but should be loaded remotely in 
a less valuable facility byia minimum number of well protected operating 
personnel. 

Installation of the spacecraft into the Shuttle is to be accomplished 
using the Payload Changeout Facility. 

It would appear that the IUS/TUG could have been installed previously 
so that only the less complex spacecraft- to- IUS/TUG interface would need to 
be connected at that time. 
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APPENDIX I 

JPL BASELINE SPACE-STORABLE PROPULSION SYSTEM APPROACH 

1 . SUMMARY 

The JPL space-storable advanced development program utilizes the 
propellant combination liquid fluorine and hydrazine and is planned for 
flexibility. The baseline choice for a propulsion system type has been 
selected and, funding permitting, will be brought to fruition by the end 
of FY 1 79. In order to minimize cost and risk, it was decided to work 
on a "blow-down" pressurized propulsion system for its first applications. 
Then, if necessary, the advanced development of those components required 
to change to an externally pressure regulated system would begin in early 
FY 1 75 in order to permit a technology demonstration of the regulated pro- 
pulsion system by the end of FY'82. This would require development of a 
fluorine vapor compatible pneumatic regulator valve. 

2. PROPULSION SYSTEM ELEMENTS 

For purposes of discussion, the propulsion system is divided into 
four assemblies, which are: oxidizer feed, fuel feed, thrust chamber, and 
structure/thermal control. For the case of the externally regulated system, 
the feed assemblies are further subdivided into a pressurant subassembly and 
a liquid subassembly. 

3. BLOWDOWN SYSTEM DESCRIPTION 

The blowdown system is illustrated in Figure 1. The feed assemblies 
consist of titanium propellant tanks, liquid isolation valves, propellant 
and pressurant fill valves, type 304 stainless steel lines, and Bobbin Seal 
mechanical joints. While the same basic components are required for both 
the oxidizer and fuel feed assemblies, the properties of the oxidizer 
require different internal material choices for those portions of the valves 
that are in contact with the propellant. The fuel feed assembly will use 
current Mariner /Vi king technology or their equivalents. The oxidizer feed 
assembly will use essentially the same isolation valve, except that 
materia! substitutions will be made to ensjre compatibility. The isolation 
valve will be located close to the propellant tank to minimize the surface 
area in contact with the LFg. The feed assemblies will be welded; however, 
they will contain one or two mechanical joint(s) per assembly. The joints 
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are referred to as Bobbin Seals. These joints were developed by the Air 
Force and were used successfully on JPL's Feasibility Demonstration Module. 
As previously noted, both propellant tanks will be fabricated from titanium 
6AL-4V. In a flight configuration, each tank would have a propellant 
management device (PMD) utilizing surface tension as the mechanism of 
propellant acquisition. A cooling coil containing flow LNg would be 
incorporated into the oxidizer PMD in order to maintain the proper LFg 
during ground-hold conditions. In the ground-test configurations, PMD 1 s 
would not be included since their function cdnnot be verified in a one-g 
environment. The oxidizer tank would contain a LNg cooling coil. This 
concept was used successfully during the Feasibility Demonstration Program. 
The oxidizer fill valve would, in all probability, be remotely actuated 
with the actuation device on the ground-half of the valve in order to 
minimize the inert mass of the propulsion system. The pressurant fill 
valve (which could also be the propellant fill valve) and burst/relief 
valve would also be derived from their earth-storable counterparts and 
therefore made compatible with LFg. 

The thrust chamber assembly consists of the engine, propellant 
shutoff valves, and gimbal mechanism. At this point in time, the baseline 
engine consists of a carbonaceous liner surrounded by a carbon-felt insu- 
lating material. A thin metal shell contains the carbon felt and ties the 
injector to the joint on the expansion nozzle which extends to an area 
ratio of 60:1. Th$ injector, fabricated from nickel, is a like-doublet 
type, with the outer ring being fuel -only for liner protection. The 
chamber operates at a pressure of 100 psia. The shuttle RCS engine valve 
will be used for fuel shut-off valve. A modification of this valve, to 
make it LF 2 compatible, will be utilized on the oxidizer side. In all 
probability, the engine will be gimbal led from the head-end through an 
angle of + 12°. 

The thermal control /structure assembly has two primary functions. 
The first is to tie the propulsion system together and to the spacecraft 
and the second is to thermally isolate the oxidizer tank from the remainder 
of the spacecraft. This will be accomplished by use of low thermal con- 
ductivity struts and radiation shields, which are state-of-the-art. In 
flight, the heat that does leak into the LF 2 tank will be radiated away. 


In order to preclude frost build-up on the LF 2 tank and feed lines during 
ground operations, they will be covered with a low density closed-cell 
foam material approximately 2 inches in thickness. The thermal conductivity 
of the foam is low enough so as to not permit the frost buildup on the ground, 
but not so low as to significantly interfere with the radiation heat rejection 
process. 

4. EXTERNALLY PRESSURIZED SYSTEM DESCRIPTION 

A schematic of the system is shown in Figure 2, 
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4.1 P ropellant Container 

The propellant container will be a key element in the safety of the 
system. The JPL design concepts for fluorine propulsion include some 
which are strongly held by the cognizant engineering groups. Features of 
note in the pressure vessel include: (References 18-20 apply) 

1. Caution with respect to Lite current trend towards "leak 
before burst" design, as they feel that experience has 
shown that this is difficult to actually achieve. They 
prefer a "safe life approach"* which the failure mode could 
be burst. Adequate margins are maintained based on fracture 
mechanics' analysis. Designs would be based on. 

2. Design of the pressure vessels to withstand external 
automspheric pressure without buckling. 

3. Their material of choice is presently 6A1-4V Titanium, 
pending further investigations currently in progress. 

5. MATERIALS COMPATIBILITY 

This section covers the material compatibility aspects of the 
Space Storable Propulsion Module (SSPM) oxidizer feed system components 
relative to the Space Shuttle during initial handling operations and 
prelaunch conditions. 

One of the major program goals for the SSPM is to provide a blow- 
down system (Figure 1) which will utilize the oxidizer, Liquid Fluorine 
(LFg), for a mission duration of up to five (B) years. The necessity of 
absolute materials of construction compatibility of the finished components 
and system for LF^ service cannot be over emphasized in order to meet the 
mission and long life requirements. 

It is axiomatic that if the component and system materials exhibit 
inertness to the LFg environment for the planetary mission requirements, 
then incompatibilities should not be experienced during all flight events 
or conditions such as ground operations, installation, take off, etc. that 
lead up to launching of the SSPM spacecraft from the bay of the Space 
Shuttle. 


As described in the safety standards and design criteria of References 1-3 
page A-16. 


5.1 Feed System Components 

The feed system components identified by function in Table I 
provide for the containment within the propulsion system of the Liquid 
Fluorine oxidizer from the initial propellant loading operation to the 
spacecraft launch. The primary and/or critical materials of construction 
are listed for each component. These materials were initially screened 
by checking their compatibility from known experience and as reported in 
the literature, references 1-17. The next step involved actual testing 
of the most critical items to verify the suitability of candidate materials 
for the application, and to ensure that the overall requirements will be 
met. 

Finally, a candidate all metal shutoff valve was designed for this 
application, fabricated, and tested with LFg. The testing demonstrated 
the ability of the valve to meet the design goals. 

5.2 Description-Oxidizer Propellant 

This section describes the general characteristics of Fluorine and 
the type of data which is available on which to base the acceptability of 
specific materials of construction. Liquid and gaseous fluorine have been 
produced and handled in industrial processes for many years. Experience 
including the handling, transportation, and disposal of tonnage quantities 
of fluorine has clearly demonstrated that it can be handled over prolonged 
periods and in large quantities. 

Fluorine is one of the most reactive oxidizing agents known, and 
can react with practically all organic and inorganic substances. The few 
exceptions include inert gases, some metal fluorides, and a few uncontaminated 
fl uorinated organic compounds. It exhibits excellent thermal stability 
and resistance to catalytic breakdown. 

Many common materials of construction are compatible for use in a 
liquid fluorine (LFg) environment in the temperature range of -306°F to 
-363°F. At these cryogenic temperatures chemical reactions in general 
tend to take place slowly, thus corrosive attack by the liquid fluorine 
is generated at a slower rate. Another factor responsible for the Tow rate 
of attack by LF« on the common metals is that thin protective films of 
fluoride compounds form on metal surfaces and act as barriers to further 

reaction. The effectiveness of the protective film formed on the metals 
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by LFg is based on the solubility of the various metal fluorides present that 
form in the film in LFg. 

To summarize, the use and satisfactory performance of fluorine is 
achievable and predictable through perfection. It demands the highest 
standards in system design, maintenance, cleanliness elimination of con- 
taminants such as moisture, and operational techniques. 

5.3 Compatibility Criteria and Available Data 

The choice of metals for use in the SSPM system is primarily 
based upon the mechrtical property requirements for the given application; 
this includes material strength and shock resistance at the cryogenic 
temperature. Other parameters considered include rate of corrosion 
resistance, ignition temperature of the metal in LFg, fluoride film reten- 
tion, and impact sensitivity. Specific aspects of detail design, fabrica- 
tion and assembly practices were also considered. 

The Material compatibil ity data used is based upon practical 
information accumulated under: 

1. NASA general research and advanced development programs. 

2. USAF development programs. 

3. NASA-OAST Advanced Technology Programs directly related 
to the Space Storable Propulsion Module development. 

This also includes the SSPM breadboard system feasibility 
demonstration test program. 

.5.4 Summary-Materials Evaluation 

5.4.1 Aluminum 

5. 4. 1.1 Discussion 

Both Aluminum alloys 2219-T87 and 6061 -T6 have been tested in LFg. 

The results from prolonged corrosion (static) exposure tests lasting over 
one year, and stressed specimens were satisfactory. A tenacious fluoride 
film was produced with a thickness in the range of 8°A. There were no 
deleterious effects as a result of the testing. 


5. 4. 1.2 Application 

The material is proposed for the burst disc application with LFg 
because of its inherent characteristic of repeatability (less susceptible 
to effects of work hardening thus narrowing the operating range band). The 
main consideration deals with an overpressure condition in the LF 2 system 
causing disc rupture and possible ignition of the aluminum alloy. 

The advantage of this material is that the melting point is below 
its ignition point with fluorine gas or about 1100°F. A series of mechanical 
properties tests were conducted to verify tensile strengths in LFg. In some 
of these tests, the specimens were fractured in the propellant with no 
evidence of adverse effects. Based upon these results, the aluminum alloy 
is considered acceptable for the application. 

c. Data Sources and/or Summaries 

References: 2-Section 3.8, 4-Chapter 3, 7-Section VII, 3, 8 through 17. 

5.4.2 Corrosion Resistant Steel 

5. 4. 1.3 Data Sources and/or Summaries 

Several alloys of Corrosion Resistant Steels (CRES) type materials 
have an extensive background of testing with LFg. They are used successfully 
in test systems handling fluorinated oxidizers including LFg, and CRES type 
304 is one of the more commonly used forms. 

Results from immersion tests (static and stressed samples) revealed 
minimal rates of corrosion. CRES steels exhibit good resistance to attack 
by hydrogen fluoride; the stable fluoride films formed of about 6^ are 
similar to those formed on Monel (a material generally used in systems 
employing hydrogen fluoride). During mechanical properties and ignition 
tests, there were no detrimental performances. 

5.4. 2.2 Application 

During dynamic operation with fluorine flow, the propellant feed 
lines are subjected to a variety of conditions, such as varying flow and 
fluid velocities, turbulence, and increases in fluid friction adjacent 
to the walls. Another critical condition can occur during the engine 
shutdown when the propellant shutoff valve is closed. Relatively high 
transient pressures and shocks are imposed locally near the shutoff valve 
for several milliseconds duration. 
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The use of CRES 304 provides a suitable material that will maintain 
a uniform protective fluoride film against erosion or other attack under 
these severe flow conditions, and a material that will meet the needs of the 
application. 

5. 4. 2. 3 Data sources and/or summaries. References 2-section 3.8, 4-Chapter 3, 
7-Section VII, 3 through 13 and 15 through 17. 

5.4.3 Inconel /Beryllium Copper 

5.4. 3.1 Discussion 

Comments from Section 2a are applicable to this material combination 
although these alloys are different types. 

5. 4. 3. 2 Application 

Under NASA contract NAS7-733, a bi propellant all metal shutoff valve 
was developed for use on the SSPM system. Extensive testing with LFg at 
the component level and on the SSPM feasibility demonstration model demon- 
strated the ability of the valve to meet the design goals and material 
suitability and compatibility. 

5. 4. 3. 3 Data Sources and/or Summaries 

References: 14, 2 through 4, 16, 17. 

5.4.4 Titanium 
5.4.4. 1 Discussion 

Propellant tanks made of Titanium alloy have been widely used on 
both manned and unmanned type spacecraft. The material offers advantages 
of: high strength to weight ratio, compatibility, low rates of corrosion, 
and well understood fabrication processes. 

System studies and analyses of the SSPM were performed relative to 
the LFg propellant tank materials that included considering both ferrous 
and non-ferrous metals. These studies established that Titanium was the 
preferred metai for the application. 

Titanium, and in particular the Alloy 6AL-4V, has demonstrated 
excellent compatibility in contact with LFg. Titanium 6AL-4V samples have 
been subjected to long term static exposure testing with LFg. After sixteen 
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months exposure definitive information has been extracted from the test 
program regarding compatibility. Gross properties, such as mechanical 
properties, were not significantly affected. The most significant changes 
were in the form of microscopic pitting on the specimen surfaces. There 
was no evidence of embrittlement. 

The material is also being investigated to determine fracture 
toughness. Numerous tests have been conducted (by JPL) using standard 
stress crack corrosion procedures with parent metal and heat affected zone 
(due to welding) samples in a highly stressed condition. Twenty-four (24) 
hour and one thousand (1000) hour duration tests were conducted with LF^ 
exposure at 300 psig. The most important result is that there was no 
evidence of stress crack corrosion growth as a result of this testing. 

5.4. 4. 2 Application 

There is some indication in the literature that Titanium may be 
sensitive to impact conditions. Typical tests involved the impact of 
various shapes of strikers on impact plates beneath the liquid surface. 

An arbitrary value of 72 ft- lb energy is used as the criteria for evaluation. 
The results reported are conflicting and inconclusive. 

The primary conclusion, resulting from a critical review of the 
SSPM flight operational functions and comparison with available data on 
reactivity, is that impact is only a secondary prerequisite for the design 
of the SSPM propellant tank. Specifically the impact source would result 
from shutoff valve operation during engine firing (section D2b); since these 
effects for the most part would be damped out locally, the effect on the 
tank would be minimal. 

The use of Titanium alloy is considered feasible for the SSPM 
propellant tank based upon compatibility and other data generated to date. 

5. 4.4. 3 Data Sources and/or Summaries 

References 8, 4, 7, 15, 9 through 14, 16, and 17. 

5.4.5 Composite Metals 
5.4. 5.1 Discussion 

Comments from section 2 and 4 are applicable to this material 
combination. 
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5.4.5. 2 Application 

The component is considered feasible and is proposed but must be 
thoroughly tested for this SSPM application. 

5.4. 5.3 Data Sources and/or Summaries 

References from sections 2 and 4 are applicable. 


Table I 


Feed System components and materials Gf construction subjected to Fluorine 
(either liquid or vapor) exposure while the Space Storable Propulsion 
Module (SSPM) is stored in the bay of the Space Shuttle Spacecraft. 



Component 

Material 

1 . 

Propellant Tank, LF 2 

Titanium 6AL-4V 
Heat Treated 

2. 

Propellant Management Device 

Titanium 6AL-4V 


(PMD) and cooling coil 

Heat Treated 

3. 

Propellant Tank, LFg, 

Titanium 6AL-4V 


Outlet cover and seal 

Heat Treated 

4. 

Propellant Feed Lines 

CRES 304L 

5. 

Transition joint tank outlet to 

Titanium 6AL-4V 


feed line 

Heat Treated To 
CRES 304L 

6. 

Isolation Valve Seat 

Inconel 718 

(may be gold-plated) 


Poppet 

Beryllium Copper 
Alloy 172, Temper H 

7. 

Fill Valve Seat 

Inconel 718 

(may be gold-plated) 


Poppet 

Beryllium Copper 
Alloy 172, Temper H 

8. 

Burst Disc 

Aluminum 2219-T87 or 
6061 -T6 

9. 

Transducer, Pressure 
Sensing Element 

Inconel 71.8 



6. ^PERSONNEL PROTECTION FOR FLUORINE 

Present fabrics offer only fair protection to fluorine contact. 
Therefore, it is essential that all operations possible be remotely 
controlled and, only under controlled emergency conditions should any 
personnel work on or near a pressurized fluorine system. 

Body Clothing 

Suits presently used by AFRPL* and JPL use a teflon coated material 
(Armalon) developed by Dupont that uses fiber glass as a base fabric. They 
also produce their "Nomex" material with teflon coating (TX0101). JPL 
has not run any tests on this Nomex material. These materials are expensive 
and difficlut to fabricate into garments. Also, as the seams of any 
garment made of this fabric are not presently armored (sealed), the possibility 
of the needle holes permitting gaseous fluorine to penetrate the suit 
presents a problem. Some easing of this problem can be accomplished by the 
use of teflon coated thread. Garments should be of a one piece "draped" 
design with no pockets, cuffs, folds or any area where fluorine can be 
trapped. No buttons should be used. "Velcro" tape or stainless steel 
snaps with at least a three to four inch overlap offers the best protection. 

It must be kept in mind that any garment design must be of the instant 
removal type. 

Hand and Foot Protection 

Gloves should be of neoprene and be of the "shake off" design and 
be "Clean - Clean Clean!" A neoprene boot with an over boot of Armalon 
offers the best foot protection. 

H ead and Fac e Protection 

A hood of Armalon worn over a neoprene mask, either in an air 
line or cylinder type self contained breathing unit, is a must. Gas masks 
and cartridge respirators offer no protection from fluorine. 

General Comments 

Any protective equipment, to offer fair protection must be 
absolutely Clean ! 

* 

Air Force Rocket Propulsion Laboratory, Edwards Air Force Base, California. 
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Emergency safety showers and eye wash fountains must be readily 
available* It must be emphasized that the best protection from fluorine 
is a remotely controlled operation. 

It is also suggested that reference be made to the JANNAF Report 
Liquid Propellant Handling, Storage and Transportation - Volume III, 
Chapter 7 Fluorine and Fluorine-Oxygen Mixtures. 
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APPENDIX 2 


GLOSSARY OF TERMS PART I NASA SAFETY DEFINITIONS* 


Accident/Incident - An unplanned event which results in personnel fatality 
or injury, damage to or loss of STS, environment, public property or pri- 
vate property or could result in an unsafe situation or operational mode. 

An accident refers to a major event whereas an incident is a minor event or 
episode that could lead to an accident. 

Caution — Notification of an impending unsafe condition. Corrective 
measures are required immediately. 

Certificate of Compliance — A formal documented buy-off of the safety 
assessment effort. 

Critical Functions — Functions required for personnel and vehicle safety. 

EVA — Activities carried out by a suited crewman in a space environment and 
outside of the spacecraft. 

Failsafe - The ability to sustain a failure without causing an accident/ 
incident. 

Flight Crew — Any personnel on board the Space Shuttle engaged in flying 
the Space Shuttle and/or managing resources on board (e.g., Commander, 

Pilot, Mission Specialist). 

Fl ight Personnel - All personnel carried on the Space Shuttle vehicle. 

Free-flying Automated Spacecraft — A payload which is deployed and separated 
from the Orbiter. 

Habitable Module — Any module in which a man may enter and perform activities 
in a shirt-sleeve environment. 

Hazard Analysis — The determination of potential sources of danger and 
recommended resolutions in a timely manner for those conditions found in 
either the hardware/ software systems, the man-machine relationship or man- 
environment relationship or combinations thereof which could cause loss of 
personal capability., damage to or loss of system or loss of life or injury 
to the public or to the environment. 

Intact Abort — An abort of the mission wherein the crew, payload and the 
vehicle are returned to the launch site. 


* 

From "Safety Policy and requirements for payloads using the national space 
transportation system" prepared by: Payload Safety Steering Group NASA 

Headquarters July 1974 (Revised October 1974). 
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Interface' - Any contact between two or more independently developed 
elements of the flight or ground systems including hardware, electrical 
connections, EMI, thermal radial ’on, man, etc. 

IUS - An Interim Upper Stage to be available at Shuttle IOC. Same as "Tug" 
but with lesser capability (viz. payload deployment capability only). 

Multiple Payloads - More than one separate payload carried in the Payload 
Bay. 

Payload — Any equipment or material carried by the Space Shuttle in the 
Payload Bay or cabin that is not considered part of the basic Space 
Transportation System. It, therefore, includes items such as Free-flying 
Automated Spacecraft, individual experiments, PSE, etc. 

Payload Safety-critical Data — That payload-originated data which is neces- 
sary for the safe, well-being of the STS. 

PSE (Payload Support Equipment) — The flight equipment needed to support 
the payload such as caution and warning, data recording, controlled func- 
tions, instrumentation, etc. 

Residual Hazards - Hazards which cannot be eliminated or controlled by 
automatic or manual backup operations and/or safety-monitoring provisions or 
other equipment. 

Safety — Freedom from chance of injury or loss of personnel, equipment or 
property. 

Safety-critical Hardware — That equipment which may affect the safety of 
the Space Shuttle flight personnel, the Space Shuttle system, the Orbiter, 
payload, the general public and public/private property. 

Space Shuttle — These elements of the Space Transportation System consist- 
ing of the Orbiter, the external tank and the solid rocket boosters. 

Space Transportation System (STS) — The Space Shuttle vehicle including the 
Orbiter, and solid rocket booster, the external tank, flight personnel and 
"carriers" such as IUS, Tug and Space! ab. 

Tug — An unmanned, high-energy, propulsive stage used to extend the 
operating regime of the Space Shuttle from low Earth orbit to geosynchronous 
orbit and beyond. -It may consist of one or more individual stages and is 
carried into low Earth orbit by the Space Shuttle. 

Warning — An indication that the safe limit has been exceeded and emergency 
procedures are to be initiated. 
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ADDITIONAL SAFETY DEFINITIONS FOR THIS STUDY 


e Requirements are a breakdown of an overall objective into a subset of 
detailed objectives appropriate to the particular vehicle system for 
which they are written. Examples: The S/C shall survice a crash landing 
without hazard to the crew. 

« Criteria are technical statements which express the conditions one seeks 
to achieve in order to meet a requirement. Example: The S/C structure 
may permanently deform under a crash landing but no S/C subsystem hard- 
ware shall separate from its attachments. 

a Specifications are translations of criteria into explicity, usually 
quantitative, statements suitable for detailed design, operations and 
test procedures. A criterion may translate into several specification 
elements. Examples: The S/C static design load factors for crash land- 
ing are "X", "Y", "Z" and the design shock load at the tug interface is 
a triangular pulse of "A" milliseconds having a peak load factor of "B" 

g- 

a Crew Safety is the condition that results from proper design and test of 
ground and flight systems operated by qualified personnel using validated 
procedures. 

• Hazards are events or conditions that could cause death or serious injury 
to ground and/or flight personnel and/or the public or severe damage to 
hardware, property, and the environment through either direct or indirect 
means, 

e Orbiter/payload interfaces are points {or areas where physical, environ- 
mental or functional relationships exist between the orbiter and payload. 
Note that the environmental interface is frequently not mentioned, but 
in practice generally not neglected: Examples: FR, radiated heat (RTG), 

ionizing radiation, etc. 

8 Systems compatibility is the condition that exists when interface design 
features satisfy the requirements of both of the interfacing systems 
and preclude environmental disturbances from one system to the other. 
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PART 3 


FUEL 

OXIDIZER - 
PROPELLANTS - 

CRYOGENIC ■ 

EARTH STOR- - 
ABLE 

SPACE STOR- - 
ABLE 

HYPERGQLIC - 

TRACTABILITY 

TOXIC 


PROPULSION DEFINITIONS 


A reducing agent which when reacted with an oxidizer will 
burn and produce heat. Fuels usually contain hydrogen and/or 
carbon. 

An oxidizing agent is any substance which when reacted with 
fuel will burn and produce heat. Oxidizers usually contain 
oxygen, and/or the halogens such as fluorine, chlorine, etc. 

Substances which store chemical potential energy. When 
burned in a combustion chamber the chemical energy is con- 
verted into thermal energy. The thermal energy is then 
converted into kinetic energy to create thrust. The term 
includes the substances before, during and after expulsion. 

Liquid propellants whose vapor pressure is more than one 
atmosphere at 20°C. Examples include LFg> L0 2 , LNg, LPG, 
etc. 

Generally refers to liquids whose V. P. <_ 1 atm at 20°C 
which boil at temperatures > 20°C at one atm, e.g., water, 

n 2 0 4 , n 2 h 4 , mmh. 

Generally refers to liquids which can be maintained liquid 
under reasonable pressure at temperatures achieveable in 
space with proper thermal radiation protection. Liquid 
hydrogen (LH 2 ) and liquid helium (LHe) are excluded, by 
definition because of the extremely low storage temperature. 

Propellant combinations are those which react and ignite 
spontaneously under usual conditions, e.g., F 9 /N 9 H- and 

n 2 o 4 /mmh. * c 4 


PROPULSION DEFINITIONS 

— The'state of being docile, i.e. , a properly passivated 
system is tractable to LF 2 

— Noxious or destructive to life or health 


A-21 


PART 4 

STUDY DEFINITIONS 


Propellant Loading or 
Propellant Servicing 


Payload Installation 


The operation of loading the propulsion 
system fluids Including fuel, oxidizer 
and pressurant gas. 

Installation of the payload stack into 
the shuttle cargo bay. 


Mating Buildup 
Integration, or Assembly 
( Propul si on Systemf 


Payload 


Mariner Spacecraft 


Cargo 

Payload "Stack" 


- Installation of the loaded or unloaded 
propulsion system into the stack con- 
sisting of payload spacecraft, spacecraft 
propulsion and IVS/Tug. This may occur 
before or after installation of the I VS/ 
Tug. 

- The STS ori biter payload as defined in 
MSC 07700, comprising up to approximately 
65,000 lb and generally contained in the 
cargo bay. 

- A Mariner class spacecraft without its 
propulsion system. 

- Same as Payload. 

- This consists of the Mariner Spacecraft, 
spacecraft propulsion and IUS/Tug 
assembly. 


IUS/Tug or 

"Undefined Nonrecoverable Tug 1 1 — An Interim upper stage or Tug which 
or Shuttle Uppe> Stage (5US ) would probably be used in a non-recover- 

able mode. 


Credible Event - This, by definition for this study, an 

event having a probability estimated 
to be greater than 10-3 occurances per 
launch. 

Possible Event — This is by definition for this study an 

event having a probability estimated to 
be greater than 10-6 but less than 10“ 3 
occurrences per launch. 


Incredible Event - This is by definition for this study an 

event estimated to have a probability of 
less than 10 -6 occurances per launch. 
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APPENDIX 3 


PART 1. TENTATIVE TANK PASSIVATION PROCEDURE 

The following passivation procedure for the propulsion system is 
a very important process as it determines the integrity of the passivation 
coating. Faulty passivation could result in propellant tank damage, 
overpressurization or leakage. 

Pending verification during development, the following steps appear 
indicated:^) 

1. At the factory after pressure and leak check and 

visual examination: (passivation assumed in acceptance test} 

1.1 clean the hardware 

1.2 passivate with nitrogen and gaseous fluorine^) 

1.3 evacuate the tank and fill with pure dry 
nitrogen to 15 psi 

1.4 seal the tank 

1.5 label the tank as passivated and containing 
metallic fluoride internal coating 

1.6 incorporate into the propulsion system 

1.7 ship 

2. At the launch site prior to use: 

2.1 repassivate with nitrogen and gaseous 
fluorine! 2) {as part of receiving inspection] 

2.2 If necessary* go through a sequence to verify 
passivation and repassivate 


NOTE: 1. All operations except attachment of fittings shall be accomp- 

lished remotely and all lines shall be purged before disconnect. 

2. Thermocouples may be used to determine if excess contaminants 
were present. 
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2.3 (first unit or pathfinder tank only) 
verify adequacy of propellant loading proce- 
dure in the explosive safe facility using a 
procedure which creates conditions equivalent 
to the actual loading-use actual LF 2 

2.4 off-load LF 2 

2.5 move propulsion system through sequence up 
to loading 

2.6 re-passivate (incidental to loading)* 

2.7 load propellant 
3. After loading 

3.1 monitor propellant status through pressure 
and temperature monitors 

3.2 thermal condition with LN 2 

3.3 store in "propulsion garage" until needed 


Steps 2.1, 2.2 and 2. 6" may be replaced by step 2.6, only. 

This procedure was kept as general as possible (and is tentative). 


t- 
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PART 2. ASSUMED LF 2 /N 2 H 4 PROPULSION SEQUENCE 


1. Assemble propulsion including cleaning 

2. Passivate and record temperatures 

3. Apply safety warning tags 

4. Ship with dry N 2 blanket at 30 psi 

5. Take N 2 sample check for H 2 0 

6. Inspect for damage 

7. System functional and valve position 

8. Leak check in loading location 

9. Cryogenic LN 2 leak check cycle 

10. Passivate in loading location (remote) 

11. Check for leaks while passivating 

12. Do not remove GF 2 (pure) 

13. Begin chill of tank with LN 2 
(controlled rate) 

14. Slowly begin to add F 2 
(controlled rate) 

15. Monitoring temperatures for vapors 

16. Complete loading (weigh F 2 ) 

17. Purge lines 3 burn or aspirate effluent 

18. Cap off lines 

19. Dispose of excess propellant. Recycle 
or react in charcoal barrels 

20. Transport and install if not already 
installed 


Locati on 
Factory 
Remote Site 

Launch site 


Loading location 
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1. SUMMATION OF KSC INSPECTIONS OCTOBER 10 & II, 1974 


ESA 6QA 

An Inspection assessment of the explosive safe area ESA 60A (in 
company of Mr. Warren Dunn of JPL) was made. This area, shown in 
Figure 4-6, has been used for loading bipropellants in Mariner 9 
and was considered suitable for loading of earth storables. It is remote 
from other complexes, the nearest installation is a parabolic antenna 
dish located 1,000 yards away. It is far from populated areas and has the 
advantage that JPL and other personnel are familiar with it. Access to 
the OPF and/or shuttle launch pad is by way of surface streets. One 
route would be across the Banana River on the NASA causeway, and past the 
Headquarters Building. This route crosses one set of railroad tracks. 

If movement were made at night with proper security, low personnel risk 
would be incurred. The ESA 60 facility appeared amenable to improvements 
which might be desired to handle fluorine. The associated Sterilization 
and Assembly Building (No. 54445} does not have a propellant facility 
drain; in any case, may not be used for this program. 

SAEF 

Alternative facilities are located closer to the Headquarters 
complex in the SAEF 1* and SAEF 2 buildings. 

These sites are less suitable than the ESA 60 because of their 

proximity to administrative buildings, although transportation distance 
would be considerably reduced. 

Vehicle Assembly Building (VAB) 

Inspection of the Vehicle Assembly Building and its neighbor, the 
Mission Control Center building, and location considerations of the OPF as 
currently conceived revealed that this is basically an assembly plant with 
the possibility of two Orbiters located in the OPF at the same time. 


it 

SAEF 1 was formerly called Pyrotechnic Installation Building, PIB*' 
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Several hundred employees are expected to be in the VAB area and the 
number could range above 2,000, When our inspection was in progress, a 
group of approximately 30 tourists was in the Low Bay Area of the VAB. 

It v/ould appear that the cost of clearing the VAB for operations 
involving transport of the Orbiter with the loaded propulsion in place 
could be very significant. Presently (past policy) pyrotechnics but not 
propellants are installed in this building but only after the Friday, 
day shift has left. Stage rollout occurs by early Monday, and personnel 
are not allowed in the building before the vehicle is clear of this 
building. It is planned to assemble the Shuttle SRB in this area and 
perhaps small amounts of liquid propellants may be handled here. 

The opinion of several personnel of the KSC was that the safety 
office would never allow hyperbolic propellant loading in the VAB. Caution 
in this building is such that pickup trucks are closely regulated and are ■ 
not allowed to remain in the building overnight. 

Consideration of passing a loaded propulsion system through the 
VAB would require development of a detailed contingency plan. 

Considerations of a credible level appear primarily damage due to 
accidental manipulation or propagation of damage from other systems. 


2. KSC SAFETY OFFICE POSITION 

The main concerns of the KSC safety office are: (1) maintaining 

normal operating conditions in the propellant handling process, expecially 
with fluorine, and (2) close control during filling and shutoff to pre- 
clude discharge of* vapors which could result in accidents. 

The KSC safety office recognizes the additional risk inherent 
during flow processes and emphasizes the need for filling in a properly 
equipped remote facility. The facility used must, in their opinion, be 
"dedicated" to fluorine by planning and scheduling although other propel- 
lants may also be loaded there. This dedication should be such that it 
precludes encroachment of other facilities into the area. 
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Loading of propellants at the pad is considered excessively 
hazardous and a last resort if other techniques are not used. 

They prefer a closed sealed system, rather than one that can be 

dumped. 

If a system is certified, it will be accepted for launch by KSC. 
This would include analysis of worst case conditions. 

The system must be such that no pressure buildup occurs during 
normal holding periods. 

The preference for a closed system stems from the conclusion that 
there is risk in fluid transfer and even detanking operations could go 
wrong, creating the problems that one would be trying to eliminate. 

It would be preferable to have tankage and lines that would with- 
stand a 14.7 psia overpressure. 

Hazardous operations will have safety office surveillance. 

Fluorine handling is expected to require rigor of operations 
approaching those for nuclear activities. 

Release of F 2 . gas at the pad would be expected to cause con- 
siderable damage to equipment at the pad. 
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SYSTEM COMPARISONS - RISK MANAGEMENT 

Because it Is more familiar, NgO^ will be used as a space shuttle 
propellant in the QMS and RCS, and will be carried in the shuttle bay in 
the OMS kits. Propellants for the OMS and RCS will be loaded directly 
into "the propellant tanks while the Shuttle is on the pad. The quantities 
of propellant were shown in Figure A-2. The recommended processing of 
the spacecraft propulsion is considered to be safer than the OMS kit 
loading process. The toxic hazard from OMS/RCS NgO^ is greater than for 
spacecraft LFg or NgO^ due to the higher quantities involved. The dis- 
persion properties of NgO^ may be worse than for LFg as it tends to stay 
near the ground. 

The comparison of the OMS/RCS system to planetary spacecraft 
propulsion is shown in Taole A7-1. A comparison of the spacecraft pro- 
pulsion with ,ther new systems and past systems as shown in Figure 2,4-2, 
can only lead to the conclusion that the hazards of the NgO^ spacecraft 
propulsion system as described in this report should be much less than 
other Shuttle Orbiter systems and that they are less than experienced in 
past practice. Risk management considerations comparing the NgO^ and 
LFg systems are shown in Table A7-1. 



Table A7-1. Risk Management Considerations 


Planetary Orbiter 
Spacecraft 

Other 

Practice 

LF 2 N 2°4 

Titan III 


Core 

OMS Kits 


1 . 

Typical weight, lb. 






oxidizer only 

1,000 

1,000 

200,000 

15,000 


" propel! ant, total 

1,500 

1,500 

300,000 

24,000 

2. 

Emergency exposure 
limit, EEL, 

19 min, ppm 

15 

30 

30 

30 

3. 

Toxic potential 
weight/EEL, ratio 

67 

33 

6,670 

1,000 

4. 

Explosive equivalent 

0.02 

0.05 

0.05 

0.05 


with amine fuel, 
TNT/lb* 

est. 




5. 

Explosive potential - 
wt. x explosive 

30 

75 

15,000 

2,400 


equivalent weight x 

(>75) 





*See Table A7-2. 


i 

! 



Table A7-2. Explosive Equivalent Factors 

i 

> 

Explosive Equivalent 
Factor Test 

Reference 

Reference 

! NgO^/AeroZine 

i- 

i 

-50 0.05 

NASA, Hydrogen Safety Manual 
1968 TMX-52454,X70-12988 

1 F 2^2 

j -* 

0.05 

NASA, Hydrogen Safety Manual 
1968 TMX- 52454 ,X70- 129 88 

V H 2 

0.60 

NASA, Hydrogen Safety Manual 
1968 TMX-52454,X70-12988 

! C1F 3 /N 2 H 4 

I 

£ 

r 

0.005 

Less severe than 

n 2 o 4 /n 2 h 4 

Research on Hazard 
Classification of New Liquid 
Rocket Propellants, AFSSD 
TR-61-40 Oct., 1961 

j W S 2 H 4 

1 

i 

0.10 

Draft Shuttle Payload Ground 
Operations Safety Handbook 

j N 2 0 4 /MMH 

t 

i 

0.05-0.10 

Estimated by Similarity to 
Aerozine-5C and NgH 4 

j i p 2 /n 2 h 4 

<0.05 
(say 0.02} 

Estimated by Similarity to 
F 2 /H 2 and C1F 3 /N 2 H 4 
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LAUNCH SITE HAZARD ANALYSES 
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APPENDIX 3 


LAUNCH SITE HAZARD ANALYSIS 


1 . INTRODUCTION 

This appendix contains the Option 3 Ground Processing Hazard 
Analysis. This appendix is part of the basis for Tasks 1 and 2. 

x This hazard analysis considers only Option 3, the selected 
processing option. Other options, except Option 4 were found to be less 
desirable from a safety standpoint than this option. Option 4 is very 
similar to Option 3. A final processing sequence selection may be made 
at a later date when more data about the Payload Changeout Facility (PCF) 
is known. For the purpose of this study it suffices to have determined 
that mating of the spacecraft with the IUS/Tug should occur in the PCF 
not in the Ori biter Processing Facility (OPF). 

I he purpose of the hazard analysis was to determine the hazards 
and necessary controls so as to be able to better compare personnel safety, 
shuttle safety, effect on timelines, effect on turnaround and relaunch and 
to provide a basis for other Tasks of the study. 

The description of Option 3 is contained in Section 4. 1.3.1 
Processing Sequence alternatives. All of the assumptions for this Hazard 
Analysis are contained in Section 4.1 specifically in Section 4. 1.3. 2. 
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ITEM/ 
TASK HO. 
( 1 ) 


OPERATIONS 

( 2 ) 


Load LF 2 /Hydrazii t e into 
the propulsion module 
in the Propellant Lab 
(ESA-60). 


Transport loaded S/C 
propulsion module to 
storage area and store 
for a week or more. 


Take propulsion module 
out of storage and 
transport to the S/C 
Sterilization and Assy. 
Bldg, in area (ESF 60) 
and mate loaded propul- 
sion module to the 
remainder of the S/C. 
Then perform minor 
checkouts. 


:L— 


PRIMARY 

HAZARDS 

(3) 


MAJOR CAUSES 
OF HAZARDS 
( 4 ) 


LIVELIHOOD OF 
HAZARD CAUSES 
(5) * 


Encapsulate electronics 
with shroud after 
checkout and prepare 
S/C for transport to 
SAEF #1 or to the 
Payload Changeout 
Facility at the pad. 


"Fuzz-leak" in the LF^ Sy< !.*■ n 
inside a building, i.e., t.he 
system is leaking sufficient gas 
to cause i lot of small gas 
bubbles to occur if a soap film 
is put on the outside of the part 
leaking N-> gas. To reach the 
TLV (0.1P rt H) for LFg In the room, 
it would t ate from T hr. to 
several hours* The concentration 
of gas is much greater near the 
leak, the propulsion module or 
S/C. A small cloud of gas could 
be formed outside the leak, and 
would prohat 1y be detected by the 
human nose before the leak 
becomes hazardous to personnel. 

It is possible that the Fuzz leak 
could develop into an inter- 
mediate leal, but it is not 
necessarily probable. 


• leak at a mechani- 
cal joint. 


Credible^ Task 1-2 


• leak out of a valve 
bellows. 


■ leak at an 

inadequate weld. 


Events of this k 4 nd 
are associated wit-i 
temporary connections 
used in transferring 
propel lants . 


> corrosion resulting 
in a small leak. 


The odor of Fo gas is detectable 
at 0.011 to 0.014 PPM. All 
individuals should be able to 
detect 0.03? PPM immediately. 


A Fuzz-leak is <,01CC/SEC at 
1 atmosphere. 


HAZARD EFFECTS IN "PRESENT" 
SHUTTLE SYSTEM AND FACILITIES 
£61 


Project Personnel 


Because personnel can smell the gas 
before it is hazardous to them and 
because they will be trained to 
recccnize the hazard, trie person- 
nel orgbably wcn't be harmed, The 
TLV for Fg gas is 0.1 PPM for 
B hours exposure. Emergency expo- 
sure limits are: 


TRW CTS has experienced 
many such leaks without 
serious incident. 


Reference (NOg) 


10 min. - 15PPM 
30 min. - 10PPK 
60 min. - 5PPM 


One of the major reaction products ; 
of fluorine gas with moisture in 
HF and its TLV is 3PPM. Laboratory 
measurements indicate that there is 
almost no reaction under conditions, 
simulating a LFjj spill into moist 
air. The emergency exposure limits 
of hydrogen fluoride gas (HF) are: 


10 min, - 20PPM 
30 min. - 1QPPM 
60 min, - 8PPM 


KSC Personnel 


No impact because of the size of 
the leak. 


General Public 


No impact because of the size of j 
the leak. 


Equipment 


Electrical control circuits can be 


damaged by Fg vapors at concentra- 
tions of less than JPPM,(4) when 


the S/C loaded with LF? is in a 
Bldg., there is a chance that 
electrical control (computers) will 
be damaged, but this is dependent 
on location of equipment, design of ] 
equipment, design of ventilation 
system, length of time the leak ^ 
has existed, when leak was detected,, j 
and the preventative measures taken, ] 


Facilities 

No impact, unless the system is 
allowed to leak for a long period 
of time so that the concentration 
build up possibly causing a fire, 
but r/ire likely causing corrosion 
of equipment and facilities. 

Timelines 


No impact on the Shuttle System 
Orbiter turnaround timeline. 


iginal page is 
Poor quality 
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OPTION 3 GROUND PROCESSING HAZARD ANALYSIS 


PRESENT* 
Cl L IT I ES 


"PRESENT" 

RISK 

CATEGORIES 


[Project Personnel 


IV unless system 
has been in stor 
age* If leak 
occurs in stor- 
age facility 
where no person- 
nel are generally 
around, the risk 
may be a level 
II* 






"PRESENT SAFETY CONTROLS 
AND ASSUMPTIONS 

W 


i Assume that an effective LFg leak 
detector is net available in the 
facil i ty. 


• There is no propellant drain in the 
Sterilization and Assembly building 
in ESA-60. 


• Isolation of electrical equipment from 
hazardous areas is not provided in the 
sterilization and Assy. Bldg* 


s It is assumed that the S/C will not 
have a gas purging shroud on the pro- 
pulsion module while the S/C is being 
checked out. 


t Electrical equipment in the ESA do not 
conform to OSHA requirements for oper- 
ating electrical equipment in hazardous 
atmospheres* 


* See Section ( ) for other safety 

controls that are assumed. 


a Present controls allow personnel to 
work around a loaded system without 
special clothing after the propellant 
is loaded. 


t Assumed that the general public is 
not allowed in the area where the 
loading occurs. 


In general the sterilization Assembly 
Bldg. (ESA 60) is not designed to 
process leaks of Fg or HF, nor are 
they designed to protect equipment 
from this leak. 


HAZARD EFFECTS 
“MODIFIED" SHUTTLE 
AND FACILITY 


RISK 

CATEGORY FG* 
“MODIFIED 11 
SYSTEM (10) 


Project Personnel 
No significant effects 


Project 

Personnel 


i Assume the present Propellant Lab is 
used to load the propulsion module* 

The present storage facilities at AFETR 
are used to store the loaded module. 
Assume the EAS-60 facilities are used ' 
to mate the S/C to the propulsion 
module. Assume Bldg {5&A, 60A) is used 
to check out loaded S/C* See Section 
( ) for description of these 

facilities. 




K5C Personnel 


No effects 


KSC 

Personnel 


General Public 
No effects 


iGeneral 

Public 


Equipment 


No effects 


Facilities 


No effects 


Timelines 


No effects 


“NEEDED" SAFETY 
CONTROLS S ASSUMPTIONS 
01 ) 


Personnel should go to a remote cc 
trol location after passivation tc 
accomplish loading operation. 

Assure that when a S/C loaded wit I 
LFg is placed in a storage facilii 
that the facility is ventilated ar 
remote. (See Note 1) from persons 

Assure that a fluorine detection t 
is available and operational befoi 
entering a closed facility contaii 
a 5/C with LF 2 . Provide a means i 
sample the air in the storage 
facility before entrance is made 
personnel or scape suit. 

Assure that the public nor other 
unauthorized personnel are allov/et 
around the storage facility. 

When the loaded S/C is not in a 
storage facility, assure that a 
portable detector and protective 
clothing are available before S 
entering an area where the loaded. 
S/C is. 

Assure that all areas in a facil i 
that contain a loaded S/C have a ] 
ventilation system that is com- j 
patible with F? vapor and HF vapoj 
and that it is isolated from othej 
areas where personnel work or may^ 
be, such as cleaning closets. (S; 
Note 2) (optional), 

Assure that all electrical control 
circuits are isolated from the ai, 
when vapors or HF vapors appea 

Install a compatible floor coveH: 
in the building such as stainless^ 
steel sheet. \ 


9. Load propellant Task 1-2 only 
under favorable weather anu wind] 
conditions. 












sIALYSIS 



"NEEDED" SAFETY 
CONTROLS & ASSUMPTIONS 
: ( 11 ) 

1, Personnel should go to a remote con- 
trol location after passivation to 
accomplish loading operation. 

2 , Assure that when a S/C loaded with 
LFj is placed in a storage facility, 
that the facility is ventilated and 
remote. (See Note 1) from personnel* 

3, Assure that a fluorine detection unit 
is available and operational before 
entering a closed facility containing 
a S/C with LF^ - Provide a means to 
sample the air in the storage 
facility before entrance is made by 
personnel or scape suit. 

4* Assure that the public nor other 
unauthorized personnel are allowed 
around the storage facility. 

5. When the loaded S/C is not in a 
storage facility, assure that a 
portable detector and protective 
clothing are available before 
entering an area where the loaded 
S/C is. 

6 . Assure that all areas in a facility 
that contain a loaded S/C have a 
ventilation system that is com- 
patible with F 2 vapor and HF vapor 
and that it is isolated from other 
areas where personnel work or may 
be, such as cleaning closets. (See 
Note 2) (optional ). 

7. Assure that all electrical control 
circuits are isolated from the air 
when Fg vapors or HF vapors appear. 

8 . Install a compatible floor covering 
in the building such as stainless 
steel sheet. 

9. Load propellant Task 1-2 only 
under favorable weather and wind 
conditions, 


Note 1: Remote from personnel activities approximate ly 

1000 ft, for 1600 lb, of fluorine and 1500 feet for 
300 lb, of fluorine. 

Note 2: It is desirable to be able to remotely control the 

ventilation in the facility to ventilate minor 
leaks and contain larger leaks. This requirement 
could be waived* 

Note 3: Task 1-2 is considered to be the most likely 

occasion for leakage, Credible is a conversative 
rating of the likelihood since the lines will have 
been leak checked and passivated* 

Note 4: It is reported. 

Note 5: Leaks up to this level are common at rocket test 

sites and may he normally tolerated if the TLV 
is not exceeded. Unnecessary personnel are 
evacuated. At K5C scape suits are recommended for 
loading operations as each one may be done w^th a 
new setup, 

Task 1-2 is where the large difference in TLVs 
between Ng O 4 and LFg is really noted since con- 
tinuing work can be accomplished with small leaks. 

Good practice dictates catching and impounding 
liquids used to neutralize spills of fluorine. 
Leakage into the air* while undeslreable 
dissipates over a wide area and is apparently not 
a problem. Loading should be accomplished when 
the wind will blow vapors toward the ocean, and 
away from facilities. 




OPTION 3 GROUND S 


net:/ 

TASK NO. 

0) 


OPERATIONS 

(2) 


PRIMARY 

HAZARDS 

(3) 


MAJOR JttSES 
OF HAZARDS 
f4) 


LIKELIHOOD OF 
HAZARD CAl’SES 




PD EJECTS I i "t’Rl ' £'<?*' 
SYSTEM a;jd FAC 1 LI Tits 
(6) 


■r.riENT- 

RISK 

CATEGORIES 


{7.5 


ITEM 

“T 

TASKJiO. 


Same as for hazard 
“Fuzz Leak" 


1-2 

1-3 

1-4 

1-5 


QRIOInl 


^Pdo: 


MDOUl! 




'‘ One Inch equivalent leak of 


liquid fluorine , “ The 
liquid may be under very 
low pressure (:14 PSIA) or 
very high pressure at time 
of the leak depending on 
the cause of the leak. 

When under low pressure, 
the leak will be like hot 
water flowing out of a 
tank. The liquid will be 
evaporating rapidly as it 
leaks, as LF 5 is a cryogenic! 
Almost any materials the 
LF ? comas in contact with 
will burn rapidly. If LF 2 
contacts water or moisture, 
?n explosion may occur, 
hydrogen fluoride gas may 
be generated. There also 
may be other dangerous com- 
bustion byproducts, The 
spilled LF 2 will cause 
a very high concentra- 
tion of ? z gas near the 
spill. The dispersion of 
the cloud depends on where 
the spill occurs and the 
environmental conditions. 
According to the ground 
rules of this study, as much 
as 3000 pounds of LF 2 could 
be leaked in a relatively 
small amount of time. 


Inadvertant valve 
operation 


Improbable 


o rupture of ground sup- 
port piping 


o rupture of LF £ tank 
o rupture of S/C piping 


o puncture of anyone of 
the above items* 


o external hazards such as 
fire, explosion, shock, 
vib, etc. 


IS 


Events of this kind 
are associated with 
failures of ground 
equipment due to unproven 
designs or user inexperi- 
ence, factors that will 
be diminished by pre- 
cautions. See columns 8, 
11 anq 12. 


Project °ersonn el 

If personnel ire In the area and are not 
clothed in protective suits, they may be 
severely injured. Even if clothed In 
protective suits there is the possibility] 
of injury. A fire will may Immediately 
fallow the spill; therefore there is a 
danger of injury due to fire. Other 
personnel in the buildings may also be 
injured because of the circulation of 
toxic vapors. 


Proje c t Persoflngj 

' n I 


I Possibli 


KSC Personnel < AF also) 


KSC Personnel 


KSC personnel located near the building 
or transporter where the leak occurs 
would be susceptible to injury. KSC 
personnel the potentially near the 
transporter when moving the loaded S/C. 
If a leak occurs in a building and a 
significant amount of LF 2 spills, the 
present ventilation systems will prob- 
ably pass the toxic gas to the outside 
of the buildings. 


Ill - gas will' 
probably diffuse^ 
before reaching j 
KSC tiers onnoV. 


II - possible ij 
pntsow.d are tq 
close to the Isaj 


If the leak occurs while in the trans- 
porter, KSC personnel will be subjected 
to the hazard if the cover is removed. 
Even if the cover isn't moved, it may be 
dampaged and the gas would escape any- 
way. If the leak occurred in the ground 
support system, the hazard to KSC 
personnel would be much greater. 


. 1 

r 1 


General Public 


General P ublic 


Tie general public may be subjected to 
the F : or HF gas hazard due to the same 
problem listed for KSC personnel. The 
HF is a byproduct of controlling the LF 
spill. If the leak occurs in the ground 
support system, the hazard to the public 
would be much greater. 

Equipment 

Extensive damage to electronic equipment 
in the facility where the l^ck occurs 
and possibly equipment ; M other facil- 
ities if the ga* m the outsfde atmos- 
phere is drafted into a facility* 


III - gas will 
nrotiabiy diffus 
before reaching \ 
tne public. 


1 1 - possible i] 
tourist* are be - } 
prn^^^secf throu^ 
tne general area 
where the 1- ‘M 
occurs . 

Eaui pment 


Facilities 


Extensive damage to ary facility where 
leek occurs, because of a fire and cor- 
rosive nature of I- gas and HF and LF ; . 


hi 

III- possible, 
porting on the ] 
amount of equip-; 
ont damaged. \ 


Fad 1 1 ties 


Timeline: 


II 


Ho significant effect because the shuttle 
operations can be carried an wfthat.i any 
of the facilities found in the operations 
of concern. 


Tinel ine 
IV 


OUND PROCESSING HAZARD ANALYSIS 


ject Personnel 
II 

I Possible 


- possible ifj 
sannel are tn I 
se to the lead 


"FRESCVT" SATtTV CONTROLS 
A'lD ASSUMPTIONS { 8) 

• Assumed that project personnel would 
be allowed to work around a 5/C 
filled with Lf- v/itbout protective 
clothing after the propulsion module 
is filled, but not during filling. 

• The Sterilization and Assembly Bldg, 
of ESA6D does not have a propellant 
drai n . 

« Fire protection personnel are avail- 
able to fight fires. They have 
suits, but not the kind that protect 
from lf z . 

• The present gas detection system is 
not sufficient. 

• Assumed that the vent system in the 
propellant room is not isolated from 
the other roams in the buildings and 
also assumed that the ventilation 
system will not be shut down once a 
major leak occurs. 


era! Public 


- possible if 
rists are bein 
cessed through 
general area 
re the Teak 
jrs, 
ipment 


same as for "Fuzz Leak" hazard. 

Assumed that there arc no means to 
stop the flow of LF; or control the 
soiil once it occurs, exeent to 
apply water spray which burns up the 
fluorine, but produces HF which is 
toxic. 

The Cape is a wild life reserve and 
most of the facilities are near this 
reserve. The citrus crops are net 
very near the facilities 


i hiZAk;, effects o:; 

"FIODjriLD 1 SHUTTLE ST STEM 
FACILITIES , , 

| 0) 

1 Project Personnel 


r;!EGcn* 
F03 "MOL-IFIED" 
SVSU* „ 0 . 


project Personnel Pr oject Personnel 

If leak occurs during transporta- jjj 

tion and personnel are not properl j jj* Residual 

suited, personnel may be severely * 

injured. 


K5C Personnel 

Personnel would probably receive 
minor injury because of the safe 
distance they are kept avray from 
the hazard, if the recommended 
controls are Implemented. There is 
a possibility of injury depending 
on _.ie safe distance established 
and the environmental conditions, i 


KSC Personnel 
III 


General Public 

No effects, because the public is 
not allowed in the area. 


Equipment 

The general electrical equipment 
in the building probably won't 
be damaged, except for the equi ■»- 
meitt in the immediate vicinity Df 
Che spill. 

FaciTf ties I 

Possible extensive amount of local' 
damage to the facility. The I 
facility damage may be minimized 
by providing a well designed con- 
trol system. 


No significant effect 


Equipm ent 

; i M 


III 

II - Possible, 
depends on how 
Targe the re- 
sulting spill 1s : 
how wel 1 it Is 
contained, and 
haw well the arei 
is rendered safe. 

Timeline 

TV 


/ "lilllUV' SAFETY 

j C^-riiLS l ASSUMPTIONS 

LI | Jill 

J Personnel should load from a remote 
-- 1 location 

n Other controls from Item 1 

p Assure that all project personnel in 
J the same room with a S/C loaded with 
J liquid Fj are outfitted in a LF 2 
j compatible scapesuit. 

jo Assure that an adequate detection 
I system is always operating, so that 
I a leak will be detected as soon as it 
I occurs* 

jo Assure chat the room containing the 
I LF 2 loaded S/C is properly isolated 
U from other rooms in the facility. 

Thfs includes the airconditioning 
system and the ventilation system. 

o Assure that all air vented to the 
outside of the building is properly 
decontaminated before release to 
the atmosphere, 

o Assure that the facility propellant 
drain system is always compatible 
with LF 2 . 

o Assure that if a Teak occurs in the 
piping of the LF ? supply system out- 
side a building, that the flow of 
LFj can be shut dawn immediately. 

o Provide an enclosed system to con- 
tain the i.F 2 spilled from service 
system. 

o Provide a means to safely detank the 
C/C of LF 2 . Assure detanking system 
Is always adequately cleaned and 
passivated. Second truck trailer 
or charcoal burner. 

o Assure that all personnel working 
around the lf 2 service system are 
properly suited. 

o Assure that the LF 2 service truck is 
adequately isolated from all outside 
hazards that may cause a 1" equiv- 
alent leak to occur. 

o Keep all unauthorized personnel a 
safe distance from the LF 7 system as 
all times, including during trans- 
portation, 

• Bldg, vent system must be designed 
so that the vapors from an outside 
spill are not drafted into the build- 
ing. 

* The general public must be kept one 
mile or greater from any point where 
the 1 oaded LF 2 systems exists. 

a Provide a means to capture the spill- 
ing liquid to prevent the propagation 
of the hazard. [ 

* Require that a LF 2 dedicated facility 1 
be used to handle and process the 

LFj system. 

• Place a shield around the 5/C so that 
spewing LF 2 will be deflected if a 
leak occurs while the system is under 
pressure 

o Install a fire extinguishing water 
fog system. 

0 Load protransport only under 
favorable weather and wind* 


Impractical - Accept r' 


Cover floor with stainless 


LYSIS 


APPENDIX 8 
FIGURE 
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EFFECTS ON 

' T '.DDI FIL’D' SETTLE S> STEM 
"'O FACILITIES 


(91 


"ll\ ( ATEGORy 
FOR "MOOIrlED" 

cy -^Trv 

~ MO) 


f+ i'FEOEE k| SAFETY 
cor POLE & ASSUMPTIONS 
(Ml 


REMARKS 

(U) 


aject Personnel 

leak occurs during transporta- 
un and personnel are not proper!}] 
ited, personnel may be severely 
jured, 


P roj fd Personnel 
Iil 

II, I, Residual 


C Pe rsonnel 

rsonnel would probably receive 
nor injury because of the safe 
stance they are keot awa y from 
e hazard* if the recommended 
ntrols are implemented, There is 
possibility of injury depending 
the safe distance established 
d the environmental conditions. 


ner-M Public 

effects, because the nubile is 
t el loved in the area, 


ulpmen t 

e general electrical equipment 
the building probably won't 
damaged, except for the equip- 
nt in the immediate vicinity of 
e spill, 

cl H ties 

ssible extensive amount of local 
mage to the facility. The 
cility damage may be minimized 
providing a well designed con- 
ol system, 

me! i ne 

i significant effect 


K5 C Personnel 
III 


[Cont. ) 


Equipment 
i I'l 
F aci 1 i ties 
III 


II - Possible, 
depends on how 
large the re- 
sulting spill is 
haw well it is 
contained, and 
hew well the are^ 
is rendered safe 

Timeline 


IV 


Personnel should load from a remote 
location 

Other controls from Item 1 

Assure that all project personnel in 
the same room with a S/C loaded with 
liquid F 2 are outfitted in a LF a 
compatible scapesuit. 

Assure that an adequate detection 
system is always operating, so that 
a leak will be detected as soon as it 
occurs. 

o Assure that the rocm containing the 
LF 2 loade C is properly isolated 
from othf. ;ms in the facility. 

This Inclu^ the airconditioning 
system and the ventilation system* 

o Assure that all air vented to the 
outside of the building is properly 
decontaminated before release to 
the atmosphere* 

o Assure that the facility propellant 
drain system is always compatible 
with LF 2 . 

Assure that if a leak occurs in the 
piping Df the LF 2 supply system out- 
side a building, that the flaw of 
LF a can be shut down immediately. 

o Provide an enclosed system to con- 
tain the LF : spilled from service 
system. 

o Provide a means to safely detank the 
VC of LF 2 , Assure detanking system 
is always adequately cleaned and 
passivated. Second truck trailer 
or charcoal burner. 

o Assure that all personnel working 
around the LF 3 service system are 
properly suited. 

o Assure that the LF Z service truck is 
adequately isolated from all outside 
hazards that may cause a V equiv- 
alent leak to occur. 

o Keep all unauthorized personnel a 
safe distance from the LF 2 system as 
all times, including during trans- 

. portation, 

« Bldg, vent system must be designed 
so that the vapors from an outside 
spill are not drafted into the build- 
ing. 

9 The general public must be kept one 
mile or greater from any point where 
the loaded LF 3 systems exists, 

a Provide a means to capture the soill- 
ing liquid to prevent the propagation 
of the hazard. 

a Require that a LFi dedicated facility 
be used to handle and process the 
LF 2 system, 

■ Place a shield around the S/C so that 
spewing LF- will be deflected if e 
leak occurs while the system is under 
pressure 

o Install a fire extinguishing water 
fog system. 

o Load protransport only under 
favorable weather and wind. 


Impractical - Accept risk in remote area such as ESA-60 


Cover floor with stainless iteel install drain to pit outside. 
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ITEM 

TASK NO. 

( 1 ) 


OPERATIONS 

( 2 ) 



PRIMARY 

HAZARDS 

( 3 ) 


Explosive rupture of S/C 
tank when filled with liquid 
fluorine . 

• If this hazard occurs in 
a building, LF 2 will be 
thrown all over the room 
and possibly blow out 
the walls of the facil- 
ities. The pressure in j 
the tank at rupture could 
be several hundred pounds 
*If the hazard occurred 
during transportation, 
the cover of the trans- 
porter would be blown 
off and a large amount 
of F 2 gas released, in 
addition to a large fire 
being created. 


MAJOR CAUSES 
OF HAZARDS 
( 4 ) 


» Tank overpressurized . 

when containing full load! 
of LF ? . | 

• Tank ruptured from ex- 
ternal hazard. 

• Leak progresses into 
major rupture. 

§ LF 2 being placed into 
the tank contacts a con- 
taminant and explodes. 


LIKELIHOOD OF 
HAZARD CAUSES 
( 5 ) 


Improbable 


Improbable 

Improbable baseu on 
experience 

Improbable if proper 
passivation procedure 


Events of this kind are 
associated with improper 
or unproven design or 
negligence 


HAZARD EF r £CTS IN] 
SHUTTLE SYSTEM AMD FJ 


Pro ject Personnel 

If the explosive rupture 
personnel working In the 
severely injured or killej 
incident occurs during trl 
personnel may be severely 
killed. 

KSC Personnel 

Same as for 1 ' eeuiv. lea 

More hazar dous to KSC persj 
transportation, j 


General Public 

! Same as for 1" equiv. leakj 
j dous to KSC personnel duri 


Same as for 1" equiv. lea 
damage to all electronic 
the area. 1 


Facility 

Extet.sive damage to facilij 
porter where hazard occursj 


FOLDOUT JptAMJjj / 













OPTIC 


ITEM 
TASK &o. 
(1) 

OPERATIONS 

(2) 

PRIMARY 

HAZARDS 

(3) 

MAJOR CAUSES 
OF HAZARDS 
(4) 

LIKELIHOOD OF 
HAZARD CAUSES 
<S) 

HiZ;RD EJECTS 111 j 
SETTLE SYSTEM AND R 

(6) j 

ITH 

TASK NO. 

1-2 

1-3 

1-4 

1-5 

Same as for hazard 
; “fuzz leak” 

. 

Explosive rupture of S/C 
tank when filled with liquid 
fluorine, 

■ If this hazard occurs in 
a building* LF 2 will be 
thrown all over the room 
and possibly blow out 
the walls of the facil- 
ities, The pressure in 
the tank at rupture could 
be several hundred pounds 
l Ef the hazard occurred 
during transportation, 
the cover of the trans- 
porter would be blown 
off and a large amount 
of F 2 gas released, in 
addition to a large fire 
being created. 

» Tank overpressurized 
when containing full load 
of LF 2 . 

• Tank ruptured from ex- 
ternal hazard. 

• Leak progresses into 
major rupture. 

• IF 2 being Placed into 
the tank contacts a con- 
taminant and explodes. 

Improbable 

Improbable 

Improbable baseu on 
experience 

Improbable if proper 
passivation procedure 

Events of this kind are 
associated with improper 
or unproven design or 
negligence 

Proiect Personnel j 

If the explosive rupture a 
personnel working in the a 
severely injured or killea 
incident occurs during tra 
personnel may be severely] 
killed, ; j 

KSC Personnel 

Same as for !' equiv. leak 

More hazardous to KSC ners 
transportation, ] 

j 

1 

i j 

! • j 

. i 

General Public i 

Same as for 1” equiv. leakj 
dous to KSC personnel durii 
tion. v • 

1 

; j 

Equipment \ 

l 

Same as for 1" equiv, leak: 
damage to all electronic 
the area.. \ 

i v * 

Facility : 

Extensive damage to fa£i|i: 
porter where hazard occurs 


FOLDOU^ pAM^ j 



OPTION 3 GROUND PROCESSING HAZARD ANALYSIS 


HAZARD EJECTS U "PRESENT" 

!'■ -TTLE SYSTEM AMD FACILITIES 

( 6 ) 

t Personnel 

explosive rupture occurs indoors, 
nel working in the area may be 
1 y injured or killed. Also, if 
nt occurs during transportation, 
nel may be severely injured or 


5 for V equiv. leak. 

azardous to KSC personnel during 
orta t ion, 


"PRESENT" 

RISK 

CATEGORIES (7) 


w PRESENT" SAFETY CONTROLS 
AND ASSUMPTIONS 


Project Personnel I Same as for above hazards. 

I 


KSC Personnel 

III - gas will 
probably diffuse 
before reaching 
KSC personnel. 

II - oossible if 
personnel are to 
close to the leak. 


t Assumed y ersonnel are alloed in the 
area where a loaded S/C exists* 

* It must be assured that proper cool- 
down of the system is provided and 
that a maximum of 3 hours will be 
required to provide adequate cooling 
if cool-down capability is lost. If 
it can be demonstrated that the LF 2 
can be safely dumped in the 3 hour 
time c;an, dumoing will suffice, 

• At the present tine the public is 
allowed to tour various areas of 
the Cane, 


HAZARD EFFECTS ON 
"MODIFIED" SHUTTLE SYSTEM 
AND FACILITIES , , 

(9 


Project Personnel 

Possible severe injury 
to personnel if incident occurs 
during transportation. 


KSC Personnel 

Same as for 1" equiv. leak, except 
during transportation, Depending 
an environmental conditions a low 
concentration of gas may be im- 
posed on KSC oersonnel 



IBJ.IIJI1JJMM 


1 - during 
transportation & 
non-filling oper- 
ations in build- 
ings. 

IV - in build- 
ing during LF 2 ' 
loading 

KSC Personnel 


i for 1" equiv. leak. More hazar- 
j KSC personnel during transporta- 


for 1" equiv. leak. Extensive 
to all electronic equipment in 


ive damage to facility or trans- 
where hazard occurs. 


General Public 

Same <xs for KSC 
personnel . 

Ill 

II possible 

Equipment 

II 

I possible de- 
fending on amount 
of equipment in 
the area. 

Faci lit' 


General Public 



General Public 

Only possible small amount of 
injury depending on environmental 
conditions, particularly if in- 
cident occurs during transporta- 
tion. 

Equipment 

Extensive damage to all electronic 
eauipment in the facility where 
incident occurs. 


Faci 1 i ty Facility 

Some as for "present" safety con- \ Residual 
di tions , 







I - during , 
transportation & 
nan-filling oper- 
ations in bui Id- 
ings. 

IV - in build- 
ing during LF 2 
loading 

K5C Personnel 
III 


Seieral Public 



C0N7RQ 


0 Same as for above hazards. 


Loading*) 


!S 

(Remote 


0 Conduct loading operations remotely 
under favorable weather conditions. 


0 Assure only safe back-road routes are 
used for transporting the S/C. Assure 
that no facility is used that is near 
K5C general personnel. Transport at 
night. 


0 Assure personnel are not allowed in 
the area where the I.F* loaded S/C 
is located. Except as necessary 


0 Buildings are designed to be explosion 
resistant e.g,, ESA 60. 


APPENDIX 8 
FIGURE I 
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REMARKS 

( 12 ) 


^he chance of this hazard occurring is small because the tank 
is not under pressure during transportation. If cooling 
capacity is lost, there are 20 hours allowed before the pres- 
sure in the tank increases to the point where the safety 
factor is lowered below -2:0. 















OPTION j 


TASK NO. 

m 

CTLRAT10N5 

(2) 

PRIMARY 

HAZARDS 

(3) 

MAJOR CANGES 
OF HAZARDS 

W 

LIKELIHOOD 0^ 
HAZARD CAUSES 
(5) 

LrFL' r; !.« 

w. *TLZ 5'3’Etf Vij FACs LI TIE:' 
(65 

ITEM 

4 

TASK NO. 
■ 1-2 
1-3 
1-4 
1-5 

Same as for Hazard 
"fuzz leak." 

Large spill of LF? from the 
service system outside a 
facility. The spill will 
come from the LF 2 tanker 
and could be up to 5 >000 
lb* of liquid F 2 . This 
hazard could occur during 
filling operations at KSC, 
during transit of the truck, 
during above ground storage 
of the tanker at KSC, or 
possibly during detanking 
operations of the S/C. Rel- 
ative to the facilities 
being used in the opera- 
tions of concern, the spill 
might occur only outside the 
propellant lab in ESA 60. 
Large amounts of NF will be 
released if the LF 2 is 
burned up with water spray. 

0 Outside hazards to the 
tanker such as an accident 
during transit, or ex- 
plosion or fire from some 
external source. 

0 Failure of the tanker 
system causing major 
rupture in the tanker. 
Failure of LF 2 service 
piping. 

The chance of this hazard 
occurring is imD rob able 
(1x10"' to 1x10-). 

Events of this type are 
uncommon. LF ? transport 
is routinely accomplished 
under ICC rules on the 
nations highways. 

Project Personnel 

A major soill outside the facility ./oulti ; 
present a severe hazard to personnel 
outside and inside the facility because : 
neither are isolated from the Hazard: 
therefore, there may be injury or death> 

KSC Personnel 

If the spill occurs on route to ESA 60, 
some KSC personnel located at the various 
test stands on the back roads may be 
severely injured because the office facil 
ities are not isolated from the outside ! 
atmosphere. Also possible injury to 
other office personnel in other areas 
depending on the size of the spill and 
the environmental conditions. 

General Public 

Because of the remoteness of the hazard 
from where the public would be, there is 
little chance that the public would be ! 
critically injured. The incidence of 
injury would more or less depend on the , 
existing environmental conditions. j 

Equipment 

Possible extensive damage to all 
electronic equipment located in the . j 

facility where tlw spill occurs. 1 

Facilities 

Possible damage to the facility because 
of fire and the corrosive action of the , 
LF 2 , HF, and F 5 gas. 

Timelines 

No effect on timeline as it is 
assumed that the shuttle can be 
rescheduled for a backup payload. 
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ON 3 GROUND PROCESSING HAZARD ANALYSIS 


f would 
nel 


=*cause 

ard; 

death. 


>A 60, 
various 
be 

:e facil- 
its i de 
to 
reas 
I and 


lazard 
lere is 
Id be 
‘ of 
m the 


‘’PRESENT" 

RISK 

categories 


m 


"P RESENT" SAFETY CONTROLS 
AND ASSUMPTIONS 


jcause 
)f the 


P roject Personnel 


KSC Personnel 


II 

I oossible 


General Public 
III 


Equipment 


II possible de- 
pending on the 
amount and cost 
of equipment. 


Faci li ties 


II possible, de- 
pending on the 
cost of repair 
of the facility 
and surrounding 
area. 


Timelines 


IV 


III possible de- 
pending on the 
demand for the 
facility being 
used. 


(« 


o Same as for above hazards. 


o Assumed that the facility vent) • itfon 
systems utilize outside air that is 
not filtered. 


o Assumed that the LF 2 tanker truck will 
not be routed past major office areas. 
Assumed that back roads v/ill be used. 


o Assumed that the oxidizer tanker is 
located on the opposite side of the 
building from the fuel tanker.* 


o Assumed no special provisions are 
taken to protect the local wild life 
or to protect the vegetation at KSC. 


o Assumed LF 2 tanker is brought on the 
base during office hours and S/C is 
filled during office hours. 


o Assumed that second shift personnel 
will be working at some facilities 
at the Cape. 


And is separated at lease 100 
feet from the building, and 
away from the assembly building. 


*aja:»d EFFECTS or* 
"MODlrltO SHUTTLE SYSTEM 
AV0 FACILITIES , t 
(9) 


Project Personnel 

Possible injury to personnel inside 
a facility because of toxic gas be 
being drafted into the facility froi 
[outside air. 


KSC Personnel 


No significant effect for personnel 
will be relocated during loading 
operations, and LF is to be trans- 
ported in the evenings when a mini- 
mal number of personnel are around. 


General Public 


Depending on the environment and 
si 2 e of spill, there ir little 
chance of injury to KSi visitors. 


Equipment 


Possible extensive damage to 
lectronic equipment in areas of 
ESA 60 facility that uses outside 
air to ventilate or for air- 
conditioning, and if the equipment 
is not hermetically sealed. 


♦cSUrti 


“KQUIFIET 
SYSTEM 


10) | 


•NEEUEIT SAFETY 
CONTROLS & ASSUMPTIONS 
( 11 ) 


Project Peronnel 


III 

II possible 


[KSC Personnel 


III 


ieneral Public 


m 


Facil ities 
III 


qui pment 

Ml 

II possible de- 
fending on the 
. anner in which 
the electronic 
equipment is pro- 
tected inside the 
facility and in 
vans parked out- 
side the facility 

Facilities 


III 


Mimel ir 


Same as for present system. 


\ imelines 


IV 

III possible 


o Same as for above hazards. 


The LF 2 will only be loaoed at a 
remote dedicated facility. 


The LF 2 truck will be escorted at KS 
by security, and road blocks wiil be 
provided. 


The LF 2 truck will be brought into tg| 
KSC area only at night after office 
hours . 


Filling operations will occur in thej 
late evening after office hours. 


Assure that no personnc 1 are working 
second-shift in areas that are po- 
tentially hazardous due to the 
environmental conditions. 


Require that personnel performing 
loading operations from the service j 
truck, wear a protective scape suit. 


Assumed that air inside the facility 
It not protected from hazardous 
gases outside the facility. 


Assure that all personnel outside a 
facility are properly protected 
during loading operations. 


The general public will not be alloy 
within 1 mile when the LF 2 truck is 
the base. 


Assumed that LF 2 tanker is routed in 
manner such that major damage will m 
occur to other KSC facilities (e.g.* 
VAB, launch stand, PCF, etc.) as a | 
result of the hazard occurrence. 





! 


1 



ersonnel Inside III 
f toxic gas be II possible 
lie facility frorr 


KSC P ersonnel 

o 

t for personnel III 
ring loading 
s to be trans- 

gs when a mini- o 

nel are around. 


General Public 
Ironmer.*' and rri 
is little 
(SC visitors. 



Same as for above hazards. This hazard is basic to the use of LF 2 . Operation of 

LF 2 transporters is routine, however, the value of 

The LF 2 will only be loaded at a facilities, and of the mission, and personnel considera- 

remote* dedicated facility. tions led to specific consideration of this hazard. This 

class of personnel hazard is routinely accepted at toxic 
The LF 2 truck will be escorted at KSC test sites, and in industrial locations, 
by security, and road blocks will be 
provided. 

The LF 2 truck wili be brought into the 
KSC area only at night after office 
hours . 

Filling operations will occur in the 
late evening after office hours. 

Assure that no personnel are working 
second-shift in areas that are po- 
tentially hazardous due to the 
environmental conditions. 

Require that personnel performing 
loading operations from the service 
truck, wear a protective scape suit. 


qui pment 

image to III 

in areas of II possible de- 
uses outside pending on the 

r or air- runner in which 

the equipment the electronic 

sealed, equipment is pro- 

tected inside the 
faculty and in 
[vans parked out- 
ride the facility 

Fa cilit ies 

III 


o Assumed that air inside the facility 
is not protected from hazardous 
gases outside the facility. 

o Assure that all personnel outside a 
facility are properly protected 
during loading operations. 

o The general public will not be allowed 
within 1 mile when the LF 2 truck is on 
the base. 

o Assumed that LF 2 tanker is routed in a 
manner such that major damage will not 
occur to other KSC facilities (e.g., 
VAB, launch stand, PCF, etc.) as a 
result of the hazard occurrence. 


ystem. 


Timelines 

IV 

III possible 
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ITEM 

TASK HO. 

0 ) 


PRIMARY 

OPERATICHS HAZARDS 

( 2 ) 1 ( 3 ) 


11 FUZZ leak In S/C LF Tank" 
See item 1 for further de- 
scription of the '’fuzz leak" 


I nstall S/C In PCF 
ixture 

This operation consist 
of the following sub- 
operations: 

• Transport propellent 
loaded S/C in the "S/C 
Transporter" to the 
launch pad. The S/C 

is transported to the 
launch pad in the verti- 
cal position with an 
environmental enclosure 
around the S/C. 

• The S/C and its 
environmental enclosure 
is then hoisted by an 
overhead crane and 
jpositioned over the PCF. 
Personnel then use guy- 
lines to guide S/C and 
enclosure as they are 
being lowered into the 
PCF. 

• The S/C environmental 
nclosure is then remov- 
d from the S/C and the 

PCF. 

The S/C is then mated 
o the PCF handling 
ixture. 


MAJOR CAUSES 
OF HAZAPCS 
M) 


Mishandling 

Leakage of propellant 
containment system. 


LIKELIHOOD Of 
HAZARD CAUSES 
( 5 ) 


Cr edible (ASSUMED) 

This hazard is assumed 
credible due to 
excessive movement. It 
could result from dropping 
the loaded system. 




it * stem a:;d facilitie: 
( 6 ) 


PROJECT PERSONNEL 

When the environmental cover of ttf 
is removed in the FCF, if the sys^j 
not been adequately purged, perso 
handling the S/C may be gased when 
environmental enclosure is removed 
longer the loaded S/C remains in J 
enclosure, the greater the risk. 


KSC Personnel 

No effect because of the size of 1 
General Public 

No effect because of the size of t 
Equipment 

Possible damage to the electronic] 
the PCF. Amount of damage depends 
well the system is purged before r 
the enclosure and the cost of elec 
equipment in the PCF. Microelect 
central circuits can he damaged wf 
concentration of F 2 of less than 1 

Facility i 

No significant effect on the facil 
because of the size of the leak. I 


Timelines 

because there is a leak the corre 
action will be to remove the S/C 3 
the facility and this will cause] 
delay in the schedules. The leak: 
then be repaired, and then the lo 
will then be reinstalled. 


HOLDOUT FRAME ) 
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OPTION 3 GROUND PROCESSING HAZARD ANALYSIS 


‘PRESENT" 

FACILITIES 


"FRESE NT" 
PI Sr. 

CATEGORIES 


( 7 ■ 


‘PRESlNT" SAFETY CONTROLS 
AND ASSUV.PT IONS , gN 

itALARD EFFECTS ON 
''MODIFIED" SHUTTLE SYSTEM 
VIP FACILITIES , . 

(s) 

CATEGORY 
;Y$:E" f]C j j 

• Assumed that the S/C is ccntinously 

PROJECT PERSONNEL 

PROJECT PERSONNEL 

orotected by an environmental enclosure 
from many external hazards 

• Assume project personnel are the orTy 
ones allowed in the area during handlini 
•of the S/C. 

NoTffect 

IV 

• Assume project personnel are not wear- 



ing scape suits. 



• Minimize the time that the S/C remains 

1 


in the enclosure. 




F. C Personnel 

KSC Personnel 

• Assumed that the Cargo Bay doors of 
the Orbiter are closed while handling 

No Effect 

IV 

S/C in PCF and that doors to the Orbiter 

General Public 

General Public 

are opened just before placing the S/C 
in the Orbitnr. 

Ho Effect 

IV 

Equipment 

III 

• Repair of the loaded S/C is not 

Fnuipment 

allowed on the pad. The S/C must be 

Possible damage to electronic con- 

11 possible 

taken back to a safe area before a renal r 

trol circuits if "fuzz leak" occurs 

i if S/C with "Fuzz 

can be made. 

in the PCF after the environmental 

leak" remains in 


enclcsme is removed and the S/C 

the PCF for an 

o The spacecraft should be stabilized 

remains in the PCF too tong. 

excessive amount 

in th 2 PCF prior to connection of the 


of timt after 

PCF and orbiter. 


leak occurs. 


Facility 

Facility 


No significant effect on the 
facility because of the size of the 
leak. 

“TV 


Timeliness 

Timelines 

III 

II - same 


Same as for "present" hazard 
effects . 


as for "present" 
hazard effects. 

i 

1 

1 

t 

1 


'NEEDED" SAFETYl 
CONTROLS t ASSUMPT-C 

(ID 


cover of the S/C 
if the system has 
ged, personnel 
gased when the 
i is removed. The 
emains in the 
the risk. 


le size of the leak 


le size of the leak, 


electronic EGSE in 
lage depends on how 
jed before removing 
:ost of electronic 
Microelectronic 
? damaged with 
less than .Ippm. 


tn the facility 
the leak. 


the corrective 
e the S/C from 
i 1 1 cause a smal 1 
The leak will 
hen the loaded S/C 
d. 


PROJECT PERSONNEI 

nr 

I! possible 
if the environ- 
mental enclosure 
is not adequately 
purged and person 
nel can't get 
away. Also 
depends on the 
amount of gas 
leaked. 

K5C Personnel 


rv 

General Public 

rv 

Equipment 
I Ti- 
ll possible 
depending on 
adequacy of purge 
and cost of equip 
ment in the PCF. 


Facility 

IV 


Timelines 


III 

II possible 
depending on the 
difficulty of 
stopping the leal 
The orbiter 
launch would be 
in a hold posi- 
tion until this 
problem is cor- 
rected. 


No personnel except authl 
personnel are allowed around! 
S/C. 

• Project personnel working) 
loaded S/C must wear appropr 
suits. 

• An F : detector must be 

useable befu*® the transport 
mental rr r can he removed L 
detect^ must be capable of 
dete^ving F 2 and HF vapors \ 
l.Oppm concentration. 

• A means must be provi dcd 9 
F vapor concentration i ns i d 
environmental cover hefore 
moved. The vapor concentrat} 
checked after purging in the 
(TBD PPM) is detected the 
removed from the PCF and tra 
a safe area; then the S/C is] 
repaired. 

• The F 2 vapor concentrate 
cover must be measured be for 
the S/C to the PCF. 

• If excessive concentration 
vapors are detected before ha 
S/C must be transported back} 
area and repaired. 

• Provide adequate assuranc 
above procedures are adherred 
have O.C. assure that oper|^ 
performed. ) 

• Continuously monitor tanksl 
detector to assur “fuzz leak] 
exist. If leak occurs while} 
remove the S/C from the PCF ] 
area and repair the S/C. 
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m 

JYSTEM 
‘ S (9) 


CATEGORY J 
"MODIFIED | 


SYSTEM f]C , j 


DEEDED’- SAFETY 
CONTROLS & ASSUMPTIONS 

(ID 


PROJECT PE RSONNEL 
IV 


§ Mo oersonnel except authorized project 
personnel are allowed around the loaded 
I S/C. 


I KSC Personnel 


IV 

General Public 


IV 


:ronic con- 
eak 1 * occurs 
'ironmental 
the S/C 
brut. 


the 

size of the 


zard 


Equipment 

III 

II possible 
if S/C with "Fuzz 
leak" lemains in 
the PCF for an 
excessive amount 
of time after 
leak occurs. 
Facility 


Timelines 


III 

II - same 
as for "present" 
hazard effects. 


# Project personnel working around 
loaded S/C must wear appropriate scape 
suits. 


• An F 2 detector must be available and 
useable before the transport, environ- 
mental cover can be removed. The 
detector must be capable of reliably 
detecting F 2 and HF vapors at less than 
l.Oppm concentration. 


• A means must be provided to detect the 
F 2 vapor concentration inside the 


environmental cover before the cover is 
moved. The vapor concentration must be 
checked after purging in the PCF. If 
(TBD PPM) is detected the S/C must be 
removed from the PCF and transported to 
a safe area; then the S/C is to be 
repaired. 


• The F ? vapor concentration in the 
cover must be measured before hoisting 
the S/C to the PCF. 


• If excessive concentration of F 2 
vapors are detected before hoistinq, the 
S/C must be transported hack to a safe 
area and repaired. 


• Provide adequate assurance that the 
ahove procedures are adherred to (e.n., 
have Q.C. assure that operations are 
performed. ) 


• CorMnuously monitor tanks with 
detector to assure "fuzz leak" doesn't 
exist. If leak occurs while in the PCF 
remove the S/C from the PCF to a safe 
area and repair the S/C. 


REMARKS 

( 12 ) 


1. Hazards comparable to N 2 0 4 . 


To insure timeline recovery a backup 
propulsion system would be desireable. 


tPLD QU% ff RAMFl 
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ITEM primary major causes 

TASK NO. OPERATIONS HAZARDS OF HAZARDS 

11 ) ( 2 ) ( 3 ) (41 


ITEM "One inch equivalent leak 11 . External hazards (e.g. 

6~ The propellant tank will mechanical damage) for 

TASK Same as for Item 5. probably be at about “o“ other causes and their 

Tnra Install SC in PCF PSIG unless cool down capab- ; choices of occurance. 

fixture. ill ty has been lost which is 

not very probable. 


Assume that the leak occurs 
after the environmental 
shroud is removed because 
the most probable cause of 
the leak is external damage 
Once spill starts, a fire 
will probably result and 
continually be fed by the 
following LF 2 * . The 
corrosive and toxic gas will 
be also evaporatinq while 
leaking. In a very short 
time probably 2-3 seconds 
an asphyxiating environment 
will exist. If the hydra- 
zine tank springs a leak as 
a result of the fire, a 
major fire will result. 
Typically 1,000 pounds of 
LF 2 could be leaked in a 
relatively short period of 
time. 



)OUT ERAJifl / 


ORIGINAL PAGE IS 
OF POOR QUALITY 


i 


LIKELIHOOD OF 
HAZARD CAUSES 
(5) 


Improbable 

An event of this type 
would be associated 
with a severe impact 
to the tank and should 
be precluded by the 
procedures established. 


HAZARD EFFECTS U 


SYSTEM AND fACIUTIE 0 


PROJECT PERSONNEL 

Possible major injury or death dependin 
on the action taken by personnel in th 
area. 


KSC Personnel 

Depending on the environmental condition 
the F 7 gas and HF gas eminating from th 
burning facility may cause injury to 
personnel at the launch pad. 


General Public 


Same as for KSC personnel if the public 
is touring any of the KSC facilities 
near the luanch pad. 




May damage exposed electrical e^uiomen 
in the area. Also the shuttle c?rgo 
bay door may be damaged due to the fin 
in the \ CF. 




i aci I i > 

Possible damage to the PCF because 
of the fire and free F 2 and HF gas. 


Timelines 

Major impact on the tineline because o 
the possible destruction of the PCF an 
possible major damage to cargo bay doo. 
Also major impact because of the 
requirement for all non-project personn 
leave the pad while these operations ar 
on. 


B 






PTION 3 GROUND PROCESSING HAZARD ANALYSIS 



"PRESENT" 

RISK 

CATEGORIES 

"PRESET SAFETY CONTROLS 
AND ASSUMPTIONS 

> /.ARD EFFECTS Oh 
"mol: TIED shuttle system 

AND FACILITIES , v 
(9) 

PROJECT PERSONNEL 

• Assume there is not a water spray 

PPOJECT PERSONNEL 

II 

system available in the PCF. 

Probably only minor injury to 

I possible 


personnel if they are properly 

depending on the 

• Assume there is no prooellant drain 

suited. 

difficulty of 

in the PCF. 


escaping after 
leak occurs or 

t Assumed that detankinq caoability is 


the delay that 

not available in the PCF. 


personnel may 
take before 

• Assume the PCF is not desiqned to he 


escaping. 

fire resistant. 


KSC Personnel 

• Assume the shuttle orbiter bay doors 

KSC Personnel 

; II 

are closed while mating the S/C to the 

No effect since only operating 

I possible, dep- 

PCF fixtire. 

personnel will be there. 

ending on the 
environmental 

• Assumed that the S/C is in an 

conditions. A 

environmental enclosure during all 


fog exists, the 

operations of Task 1-18 except when 


F 2 gas may be 

being mated to the PCF fixture. 


more hazardous. 

• Assume , scape suits are available but 

General Public 

General Public 

not normally worn durinq Task 1-18. 

No effect for all oas eminatinq 

hi 


from the spill will he contained. 

II possible. 

• Assume that a portable dry chemical 

depending on the 

fire extinnuisher is available. 


environmental 

conditions. 

• Assume that an escape route is 


Equipment 

available to the PCF. 

Equipment 

II 

• Assume that the spilled LF 2 cannot 

No effect for all eouiDment if 

», possible 

be drained out of the PCF. It is assumed 

properly isolated from the hazard. 

because of Doten- 

that in general, the PCF is not designed 


tial damage to 

specifically, to handle payloads loaded 


the shuttle 

with o rope 1 lent. 


because of fire 
in the PCF if | 

• Assumed that the pressure vessel is 


the PCF cannot | 

enclosed with an environmental enclosure. 


be moved away 
fast enough to 

t Assumed that only necessary project 


orotect the 

personnel are allowed on the stand and 


shuttle cargo 

pad during the handling of a loaded S/C. 


b ay doors from 
damage. 

• Assumed that the PCF can be moved awav 


Facilities 

from the Shuttle if a fire occur: in the 
PCF. 

Faci 1 ities 

1 1 - maximum 


Minor damage due to stray gas and 

assured damage 


LF r not contained by the hazard 

potential to the 


control system. 

PCF 

Timelines 


Timelines 

There will be some impact on the 

11(3) 


timeline because the S/C will he 

probably greater 


severely damaged and will have to 

then 3 day delay. 


he removed from the facility. 


Also the PCF will have to be 



refurbished before it can be used 
again. 


;r_i> CATEGORY 
-0- " MODIFIED" 
sy£7E * < 10 . 

PROJECT PERSONNEL 
III 


KSC Personnel 


IV 


General Public 



Faci li ties 
III 


Timelines 


"uSECED* SAFETY 
CONTROLS & ASSUMPTIONS 

rn) 

o Protection from impacts 

o Assume that a LF 2 compatible 
ventilation system is available in the 
PCF to vent out vapor from a F 2 spill. 

o Provide a detanking capability for 
LF 2 while initially mated to the PCF 
handling fixture. 

o Assume that electronic equipment 
is isolated from the environment 
where F 2 or HF gas may exist. 

o Assume that cargo bay doors of 
orbiter are closed during this 
opera ti on . 

o Assume that the PCF can be removed 
away from the orbiter in case of a 
spill . 

o Assume that the PCF is basically 
designed with fire resistant materials \ 
on the interior surfaces. 

o Assume that project personnel wear, 
the LF 2 compatible scape suits while 
handling the S/C. 

o Allow only project personnel on the 
stand during Task 1-18 operation. 

o Assume that detection and alarm a* e 
available to detect and sound an ale.'m 
upon initial indication of a leak. 

d Assume that a portable day chemicvl 
(SODA ASH) fire estinguishing syste i 
is available. 


o Do not allow the pouring of large 
quantities of water on the LF 2 spill. 

If water is used, only use a fine water I 
spray. Large amounts of water may |l 
cause explosion. 


i 







s 


PAGE 6 OF 8 


Ori 

SYSTEM 

ES 

9 


jury to 
Droperly 


Derating 


iminatinq 

contained. 


wnent If 
the hazard. 


ay aas and 
e hazard 


ct on the 
C will he 
11 have to 
i 1 i ty . 
to be 
an be used 
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10) 


[project p ersonnel 
III 


KSC Personnel 

IV 


General Public 
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Equipment 
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Facilities 

III 

Timelines 


"i'lEEDED' SAFETY 
CONTROLS & ASSUMPTIONS 
( 11 ) 


o Protection from impacts 

o Assume that a LF 2 compatible 
ventilation system is available in the 
PCF to vent out vapor from a F 2 spill. 

d Provide a detanking capability for 
LF 2 while initially mated to the PCF 
handling fixture. 

o Assume that electronic equipment 
is isolated from the environment 
where F 2 or HF gas may exist. 

o Assume that cargo bay doors of 
orbiter are closed during this 
operation. 

o Assume that the PCF can be removed 
away from the orbiter in case of a 
spill . 

o Assume that the PCF is basically 
designed with fire resistant materials 
on the interior surfaces. 

o Assume that project personnel wear 
the LF-, compatible scape suits while 
handling the S/C. 

o Allow only project personnel on the 
stand during Task 1-18 operation. 

o Assume that detection and alarm are 
available to detect and sound an alarm 
upon initial indication of a leak. 

o Assume that a portable day chemical 
(SODA ASH) fire estinguishing system 
is available. 

o Do not allow the pouring of large 
quantities of water on the LF 2 spill. 

If water is used, only use a fine water 
spray. Large amounts of water may 
cause explosion. 


REMARKS 

( 12 ) 


(1) The shuttle orbiter is considered under the category of 
equipment and not facilities. 

(2) The worst case category for the timeline is a category II. 

(3) Oxidizer ventilation systems were considered for the PCF, 
however since the major hazard is during crane operation, 
when the S/C is outdoors, this complication seems excessive. 


tX,U)0 - ( S HUi 
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MAJOR CAUSES 
OF HAZARDS 
( 4 ) 


LIKELIHOOD OF 
HAZARD CAUSES 
(5) 


PRIMARY 

HAZARDS 

(3) 


OPERATIONS 


Project Personnel 

Because the leak is small , pi 
detect by smell before ft bei 
ardous to personnel* It is 1 
the S/C will be in the PCF oi 
only for a short period of t 
le£ Is detected, see note C 


Credible (or 
improbable). This 
hazard is assumed 
credible to ensure pre- 
cautions will be man- 
dated. It would appear 
much less likely than 
Item 5 which involves 
a crane operation. 


See Item 5 for causes of 
the hazard. 


“Fuzz leak in the S/C tank 
The description of hazard 
is the same as for Item 5. 


'Install S/C into the 
Orbiter and mate to 
the I US/TUG." 

This task consists of 
the following sub- 
operations: 

t The Orbiter cargo 
bay doors are opened 
(T -35 hrs. ) . 

t The S/C is raised to 
the right height 
(see Figure ) in 
the PCF payload 
handling fixture. 

• The S/C is then in- 
serted into the 
cargo bay of the 
Orbiter by travers- 
ing the S/C horizon- 
tally through the 
PCF to the Orbiter. 

• The S/C is then 
lowered and mated to 
the I US/TUG. 

• Connect LNo coup- 
ling. Install 
RTG (T -27 hrs.). 

• Close cargo bay 
doors (T -22 hrs. ). 

• Payload readiness 
test (T -15 hrs.). 

• Clear pad (T -10 hrs) 

• Servicing of Orbiter 
and IUS with propel- I 
lents (T -«5 hrs. ). 

• Open pad (T -6 hrs.). 

• Service disconnect. 

• Retract Payload 
Changeout Facility 
(T -»2 hrs.). 

• Clear pad (T - *1 hr) 

• Countdown 

• Liftoff (T -0) 


K5C Personnel 

No effect because of the size 
leak. 


General Public 

No effect because of the sizi 
leak. 


Equipment 


See note; 


No significant effect on the] 
because of the size of the li 


Timeline 


Same as for Item 5. The imp| 
timeline is greater for Iteraj 
there are more operations thi 
performed to remove the S/C J 
facility from the Orbiter if 
occurs. 


1 Major impact on the timeline 
possibl* damage to the PCF ai 
i Orbiter. 


Also a l«r,ser impact on the r 
there Is a hold of the Orbit e| 
for -,oo long. 


'OUT FRA\rg / 
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ZARD ANALYSIS 


HAZARD EFFECTS ON 
“MODIFIED” SHUTTLE SYSTEM 
AND FACILITIES ^ 

Project Personnel 
No effect 


ICC Personnel 
No effect 


:< CATEGORY 
S •'MODIFIED" I 

CVC‘ r ?^ 

" - , ' t " ( 10 ) 


General Public 
No effect 


Project Personnel 
IV 


KSC Personnel 


General Public 


' .CEDED" Si 
CONTROLS & ASSUl 

(111 

• It is assumed that th 
dump capability fori 
being traversed acros 
Orb iter cargo bay. 1 

• Same safety controls! 

• Assume that an effec 
F 2 detector will autf 
F 2 vapors from the L 
occurs. Also assure) 
required to operate! 

• Assume that the Orbll 
be adequately purgedS 
are allowed to enter! 


Equipment 

Same as for Item 5. 


Ill 

II-Possible, same 
as for Item 5. 


No effect 


Timeline 

Same as for Item 5. 


Timeline 

III 

II-Same as for 
Item 5. 


Facilities 

Same as for Item 6. 


Facilities 


Timeline 

Possible significant Impact on the 
timeline due to the need to 
refurbish the PCF and the Orbiter. 
Also an impact if there is a "hold 
for the Orhiter. The S/C LF tank 
would probably have to be cooled 
down anain before launch to orovide 
greater assurance during orbit that 
wor. 't be an over pressurization of 
the S/C LF 


Timeline 


*:iCE9ED“ SAFETY 
CONTROLS & ASSUMPTIONS 
( 11 ) 



ITEM 

TASK NO. 

0 ) 


ITEM 

8 

TASK NO . 
1-19 


OPERATIONS 

( 2 ) 


Same as for Item 7 


PRIMARY 

HAZARDS 

(3) 


One-inch equivalent leak 
Ifrom the S/C tank when under 
yery low pressure.” 


See Item 5 for additional 
description of the hazard. 


MAJOR CAUSES 
OF HAZARDS 
( 4 ) 


• External hazards that can 
cause damage to the S/C 
tank. 


• Other hazards identified 
by a hazard analysis of 
the CDR S/C design, final 
operations concepts, 
final Orbiter design and 
I US/TUG design. 


• The I US/TUG becomes a major 
hazard to the S/C LF 2 tank 
after the JUS/TUG is 
serviced with propellants 
and tanks are pressurized. 


LIKELIHOOD OF 
HAZARD CAUSES 
(5) 


hazard l :f 

jTTLE SYS 


Improbable 


holdout frame ) 


The chance of an LF 2 
leak occurring after 
being installed in the 
Orbiter and mated to 
the IUS/TUG is much 
less than the chance o' 
the incident occurring 
before the mating of 
the S/C to the IUS/TUG, 
The chance of the spi 1 ' 
occurring during this 
phase appears to be 
directly proportional 
to the S/C hydrazine 
tank or the high pres- 
sure vessels on the 
IUS/TUG exploding and 
causing damage to the 
LF 2 tank, or any bat- 
teries exploding. 

2 It should also be 
considered that if an 
extensive hold occurs, 
the LF 2 tank may over- 
pressurize due to loss 
of cooldown. 


Project Personnel 


If leak occurs be* 
bay doors there i 
severe injury to| 
death. An asphyaj 
F 2 gas will occur 
seconds) after thi 
a fi re will also 


KSC Personnel 


Same as for ITEM ( 
additional dangerj 
occurs after the 
closed and the IU^ 
are serviced. 


General Public 
Same as for ITEM j ( 


HF hazard. 


Equipment 
If leak occurs in 9 
cargo bay doors ari 
the same as for It| 


If the leak occurs 
the cargo bay doori 
IUS/TUG and the o| 
results will probaj 
the sense that a 
will probably occu 








OPTION 3 GROUND PROCESSING HAZARD ANALYSIS 


.-:A2ARD EFFECTS Vi “PRESENT'’ 
SrjTTLE SYSTEM AND FACILITIES 
( 6 ) 


>ject Personnel 1 

leak occurs before closing of the cargo 


doors there is a possibility of 
•ere injury to personnel and possibly 
ith. An asphyxiating environment of 
gas will occur almost immediately (2-3 
:onds) after the leak occurs. Also 
Mre will also probably cccur. 


Personnel 


le as for ITEM (6). There is an 
litional danger to personnel If leak 
:urs after the cargo bay doors are 
jsed and the IUS/TUG and the Orbiter 
> serviced. 


•’PRESENT*' 

RISK 

(A T EG0RIES , 7 > 


PRESENT" SAFETY CONTROLS 
AND ASSUMPTIONS 


(E) 


Project Personnel 


II 

I possible 


KSC Personnel 


II 

I possible 


leral Public 


lie as for ITEM 
hazard. 


(6) because of the F 2 and 


iipment 

leak occurs in the PCF before the 
rgo bay doors are open* the effects are 
3 same as for Item 6, Col. 6 "EQUIP." 


the leak occurs in the cargo bay after 
3 cargo bay doors are closed and the 
5/TUG and the orbitor are serviced the 
suits will probably be catastrophic, in 
2 sense that a lame fire and explosion 
11 probably occur in the cargo bay. 


General Public 


III 

II possible, 
depending on the 
environmental 
conditions. 


Equipment 


II if leak 
occurs in PCF. 

I if leak 
occurs in the 
Orbiter. 


• Assumed that project oersonnel are not 
wearing scape suits during handling of 
the S/C in the PCF or when installing the 
RTG on the S/C in the Orbiter carno bay. 


• Assimed that there is no means to 
control the leak once it occurs except 
that if the leak occurs before the 
Orbiter cargo bay doors are closed, 
the PCF may be rolled ou* of the way to 
minimize damage tc the Orbiter. 


• It is assumed that no emergency dump 
capability is provided. 


• See note 6. 




hazard EFFECTS ON 
"MODIFIED" SHUTTLE SYSTEM 
AND FACILITIES , , 
(9) 


CAT£30R V i 
“MODIFIED" * 

SYSTEM 


HO) 


Project Personnel 


Possible injury only if scape 
suit is not adequate. 


Project Personne l 
III 


KSC Personnel 


KSC Personnel 
TV 


General Public 


Same as for item (6) because of 


theF 2 and HF hazard. 


General Public 
TV 


Equipment 
Same as for item 6 before the pay- j: 
load bav doors are ooen. After 
the carqo bay doors are closed and 
a leak occurs, there will be some 
damage to the Orbiter and the 
oayload stack, to the extent tha* 
the mission will have to be 
cancelled and the Orbiter will have! 
to be refurbished. It is probable 
that the LF? will not be contained { 
when the spill occurs. This will j 
create a toxic and very corrosive 
atmosphere in the Orbiter cargo 
bay. 


Equipment 

lu- 
ll possible 
depending on the 
effectiveness of 
the shroud 
system and the 
length of time 
it takes to 
ventilate or 
purge the cargo 
bay. 


• Same 

• see m 


• Prope 
provided 
transvffi 
and mati 


• It 
dump capj 
provided 
IUS/TUG 


• It s 
wil . proi 


• It is 
be prot 
if it 


• Assuij 

wi 1 1 
LF2 compM 
bay do 
the ite 


See 


• Assn 
is avai 
Orbi ten 
the If 2 


TS ON 
E SYSTEM 
TIES , * 
v9) 

; CATEGORY 

"XODI FI ED" 
SVSTEM (10) 

'NEEDED" safety 
CONTROLS & ASSUMPTIONS 
(11) 

REMARKS 

(12) 


Project Personnel 

• Same safety controls as for item 6. 

(1) It is assumed that "project personnel" will leave the ptd 

If scape 

III 

• see note 4. 

and not return before the Orbiter, IUS/TUG is serviced. ' 




(2) It is assumed that there is cool down capability before 



• Propellant dump capability is not 

and after the payload bay doors are closed. With 20 hour 



provided during the time the S/C is 

leeway before loss-of-cool-down would be the cause of a 


KSC Personnel 

transversed into the orbitor cargo bay 
and mated to the IUS/TUG. 

hazard. 

(3) The Orbiter is considered part of the equipment category. 


• It is assumed that on "automatic" 


IV 

dump capability for the LF tank is 

(4) It is assumed that a rapid means of escape is provided for 



orovided while the S/C is mated to the 

the Orbiter crew if a major hazard occurs in the Orbiter cargo 



IUS/TUG in the orbitor cargo bay. 

bay. 



• It is assumed that the shroud system 
will provide some degree of containment. 

(5) The worst case category for the timeline is a category II. 

(6) The availability and use of a standard fire protection 



• It is assumed that the IUS/TUG will 

system is not sufficient to control the hazard or lower the 



be protected from a low pressure spill 

hazard category after Orbiter and IUS/TUG propellents are 



if it occurs by the shroud. 

loaded. 


General Public 
IV 

• Assume that the Orbiter cargo bay 
will be adequately ventilated into an 
i LF? compatible system before the cargo 

(7) It is assumed that there is not a leak of fuel on the 
existence of fuel vapors around the 3/C at the time the LF 
leak hazard occurs. 

because of 

i bay doors can be opened for repair of 
the items. 

• See note 8. 


(8) It is assumed that personnel will not te allowed to enter 
the cargo bay after the cargo bay doors are closed; therefore 
the availability of a portable fire extinguishing system will 
be of no help to control the hazard. 

• Assume that an extinguishing system 


Equi pment 

is available to put out fire in the 


ifnre the pay- 

III 

Orbiter and the PCF that resulted from 


ien. After 1. 

II possible 

the LF^ leak. 


re closed and 1 

deoending on the 



will be some I] 

effectiveness of 



• and the 

the shroud 



extent that t 

system and the 



to be 

length of time 



iter will have! 

it takes to 



t is Drobable 
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APPENDIX 9 

FLIGHT HAZARD ANALYSIS 

1 . INTRODUCTION 

This appendix contains the Mariner/Oxidizer/Shuttle Orbiter primary 
and secondary Hazard Analysis for Tasks 5 and 6, and from part of the basis 
for those tasks. 

The general approach used in this task was to (1) define the mis- 
sion operational sequence, (2) define system characteristics, (3) perform 
the hazard analysis and postulate corrective actions and hardware, and 
(4) compare alternative system options in view of the hazard analysis. 

This hazard analysis is based on the foundational data and mission 
operations described in Section 4.5.1, Task 6. That section should be 
read before this appendix. 

The "hazard analysis" format used is very similar to the hazard 
analysis described in Section 4.1 of this report, although in this task 
two slightly different hazard analysis formats were used. The first format 
was used to analyze the "primary hazards" that exist or may exist, when 
launching the Mariner spacecraft and the IUS/TUG when using LF^ and N2O4 
during normal mission operations (includes Orbiter abort operations) and 
the abnormal operations that may occur during an unplanned extended mis- 
sion and other conditions. 



The second type of hazard analysis format was used to analyze 
secondary hazards that exist or may exist during off-load of the oxidizer 
during launch, orbital, and abort conditions. From the primary and 
secondary hazard analyses the information needed to answer the Task 6 is 
derived. 
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OPERATION,' 
MISSION 
PHASE / 1 , 


OPERATIONS 

( 2 ) 


Normal Operations 


Liftoff of orblter to 
SRM Separation (T*0 to 
t ■ 2.03 min) • 


PRIMARY' HAZARDS 
(3) 


1; Fuzz Leak from the outer 
shell (the shell contain 
liquid from the primary 
tank) of the LF ? tank. 


MAJOR CAUSES OF HAZAkOS 
(4) 


LIKELIHOOD OF HAZARD 
CAUSES (5) 


1. Normal vibration and Incredible 

shock to the oavload 

and hi qh acceleration 
forces. 

2. Undetected leak which Improbable 

occurred durinq around 
operations. 

3. External hazards to the tTOrohable 
nayload: ruoturlnn of 

pressure vessels, fire, 
hazards to P/L from tuo A 
orbiter. 

4. Capillary Lea» hrouoh Improbable 
the tank and shell for 

anv of several causes 
internal to the LF ? 
system. 

5. Over pressurization of Improbable 
LF 2 tank and from He tank 


! Improbable 


Improbable 


Improbable 



HAZARD EFFECTS ON SHUTTLE 
ORBITER 
( 6 ) 


k 


2) Intermediate leak throuahl Same as for Operation I, 


the primary tank wall 
and the outer leak-oro- 
tection shell. 

A secondary hazard is 
destruction of the orbi- 
ter dump system because 
LF 2 is incompatible with 
the dump system. (Refer 
to Level II Analysis) 

Bum throunh or leaklnn 
F, qas from an inade- 
quate LFp dumo system 
when the^LF« is eiumoed. 
(Refer to Level II 
Analysis) 


Mission Phase 1, exceot 
possibly a little less 
llkelv to occur, 
items, 1, 3, 5 


Same as for Operation I, 
Mission Phase 1, except 
possibly a little less 
likely to occur. 


(Current Effects) 

o Minor corrosion to orbiter. 

o Possible reaction with moisture in ca 
bay, air or purge gas which will yiel 
corrosive HF gas. This gas will caus# 
very little corrosion because of the ^ 
of the leak. 

(Delayed Effects) 

o Monitor corrosion to orbiter. 

o The extent of corrosion depends on 
corrective action taken (e.g., was 
the payload deployed or was the 
propellant dumped. 


0 ITER PERSONNEL 
iCjrrent Effects) 

No impact on crew during the boost phase 
For all the c rew is in the craw cabin 
vhich is isolated from the pa* load bay} 
the airlock. 

(Delayed Effect) 

No impact on the crew during later pi 
of the mission unless a man is requv 
enter the pay lo3d bay during an emerge 
(Unlikely event). See for addition 
effects. 

ORBITER 

•| (Current Effects) 


K 


Same as for Operation I, Mission 
Phase 1, except t h e corrosion an 
chance of fire is greater. Also 
fire hazard would be qreater if t 
are fuel vapors in the cargo bay I 
the same time. The chance of a h 
order explosion is low because thi 
F 2 vapor is hyoergolic with the pi 
tential fuel vaoors. 

( Dt ' <> ed Effects/ 

See secondary hazard analysis.' 


ORBITER PERSONNEL 
(Current Effects) 

« No impact on the crew during Miss 
Phase 1. 


gWiTmMJryriiiflis 


ORIGINAL PAGE 
OF POOR QUALT1 


(Delayed Effects) 

Possible injury to personnel late 
on in the mission i */ personnel wej 
required to enter the carno bay dt 
to an emergency; e.g., for some I 
reason the oayload cannot be depl< 
automatically but must b? deployei 
manually. 



LIGHT PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 


SWJTTIE/MRINER BASELINE SYSTEM 


SHUTTLE/MAR MER PEREERRED SYSTEM 


"e in cargo 
111 yield 
ill cause 
of the jize 


RISK CATEGORIES | SAFETY CONTROLS AND ASSUMPTIONS 
(7) I 


o S/C desiqn is that assured in Figure 
o The oases In the orbiter cargo bay are 
continuously vented dur.ng boost 
operations. 

o Prior to boost, the cargo bav is purged 
with N 2 gas. 

o The shuttle crew area is isolated from 
the carno bay area durlna boost via 2 n 
airlock. 

o The LFp tank has a fluorine compatible 
shell around it to contain any "fuzz 
leaks" or Intermediate leaks." 
o The time the orbiter is exnoseu to a 
fuzz leak will be small. If a fuzz 
leak occurs, the shuttle should 
continue to orbit then proceed to the 
orbital leak procedure (TBD) . 
o The S/C mission may or may not be 
cancelled. 


>st Dhase. 
cabin 
oad bay bv 


HAZARD EFFECTS Oil SHUTTLE 
ORBITER 

( 9 ) 

ORBITER 

(Current Effects) 

No effect on the orbiter if an 
effective shroud is designed. 

’(Delayed Effects) 

lie effect on the orbiter if an 
effective shroud is designed 


ORBITER PERSONNEL 


No impact on orbiter personnel. 
Same reason as for the base line 
desiqn. 


RISK CATEGORY SAFETY CONTROLS & ASSUMPTIONS 

(10) (ID 


o Same controls a* in Column 8. 

o The conolete S/C Is covered with a 
shroud which isolates possible gases 
from the orbiter. 


■ 

■ 


(Delayed Effects) 

No effect on orbiter 
personnel 


r phases 
required to 
i emergency, 
idditiona) 


II Possible if 
lission there is a fuel 

ion and vapor present in 

Also the the cargo bay. 
er if there 


See secondary 
hazard analysis 


TI or I nosaible 


Same as for Operation I, Mission Phase 

1 . 

If an intermediate leak occurs, the 
shuttle orbiter should continue to 
orbit. The S/C mission should be 
cancelled. The orbital leak nroce- 
dure (dumn or deolov) should he insti- 
tuted. 

Assumed the normal orbiter hynergollc 
dimio system is used for dumDinq the 

le 2 . 

The earliest time possible to onen 
the carao bay doors is T = 2 minutes. 


ORBITER 

(Current Effects) 

Normally there is no effect on the 
Orbiter but if the complete shroud 
fails to relieve internal pressures 
in the event the LF 2 tank leak 
occurs, a leak through the shroud 
mav occur and allow oas to leak 
into the Orbiter carqo bav which 
could cause corrosion. 

(Oelaved Effects) 

If the leak occurred durinq this 
ohase (Boost) and was allowed to 
continue, the shroud mav he over 
pressurized and cause damage to the 
orbiter but not completely disable 
it. 

ORBITER PERSONNEL 


No impact to orbiter personnel for 
they are not allowed in the area 
when the gas vaoor may ^xist. 

(Delayed Effects) 

No significant effect if trie 
s roud prevents the gas from 
er tenng into the cargo bay. 

Th • LF 2 will be dumped. 


!V - II possi- 
ble, because of 
cost of damage 
to orbiter. 


Same as for Operation I, Mission Phase 
I above. 

The shroud is desioned to be resistant 
to F 2 corrosion. 

The shroud is designed to prevent 
a high concentration of Fp vapors from 
escapinq into the cargo bay. 

The shroud must also be vented to the 
outside of the orbiter carqo bav to 
prevent nressure build uo inside the 
shroud. 

Assumed that an LF^ comnaclble damn is 
nrovided. 

P» a the leak is detected, the LF ? mav 
be dumped. 

Personnel not allowed In the cargo snace 
in any phase of flight when there is a 
leak in the LF^ tank. 

Assumed that instruments are aboard that 
detect a leaking F 2 tank. 


I" 


l 


HOLDOUT, 




SHUTTLE/HARINER PERFERRED SVSTEM 

EFFECTS Oil SHUTTLE 
ORBITER 
(P) 

RISK CATEGORY 
(10) 

SAFETY CONTROLS & ASSUMPTIONS 
01) 



Effects) 

t on the orblter If an 
e shroud Is designed. 

Effects) 

t on the orbiter if an 
i shroud is designed 


o Same controls as in Column 8. 

o The conDlete S/C is covered with a 
shroud which isolates possible gases 
from the orbiter. 


o' The effects on the TUG or S/C is evaluated only if it can 
cause propagation of damage. 

o It is assumed that the SHUTTLE/MARIHER S/C and the IUS/TUG are 
the only Dayload items in the carao bay during the Mariner 
Shuttle Mission. 

0 It is assumed that the OMS kit will not be in the carao buy 
during the Mariner Shuttle Mission. 

o The earliest time the cargo bay doors can be open is +2 min. 
This is due mainly to the time reg. for reconfiguration 
(approx. 4 min.) after MECO. 


; on orbiter nersonnel. 
ion as for the base line 


Effects) 

; on orbiter 


ORBITER 

irrent Effects) 

:here is no effect on the 
it if the complete shroud 
'?.} i eve internal pressures 
:nt the LFg tank leak 
leak through the shroud 
and allow nas to leak I 

Irbiter cargo bav which ’ 

e corrosion. 

Delaved Effects) 

k occurred durinq this 
•s t) and was allowed to 
the shroud may be over 
;d and cause damage to the 
it not completely disable 


IBITER PERSONNEL 


irren 

to orbiter nersonnel for 
ot allowed in the area 
as vanor may exist. 

Delaved Effects) 

cant effect if the 
vents the gas from 
nto the cargo bay 
11 be dumped. 


IV - II possi- 
ble, because of 
cost of damage 
to orbiter. 


Same as for Operation I, Mission Phase 
I abovp. 

The shroud is designed to be resistant 
to corrosion. 

The shroud is designed to prevent 
a high concentration of F« vaDors from 
escapinq into the cargo bay. 

The shroud must also be vented to the 
outside of the orbiter carqo bay to 
prevent pressure build uo Inside the 
shroud. 

Assumed that an LF ? compatible dump is 
provided. c 

Once the leak is detected, the LF« may 
be dumped. ^ 

Personnel not allowed In the cergo soace 
in any phase of flight when there is a 
leak in the LF 2 tank. 

Assumed that instruments are aboard that 
detect a leaking F^ tank. 


A passivated line requires passivation on qround and is a 
minor hazard involving a GF 2 bottle, etc. 




foldout frame*3 






mr CATrWPf Mr 

(10) 


wA/s=n trrfcrs u*. ;-.”l i oppitep 
(») 


lUEll u/ Y)D OF HAZARD 
CA.SES (5) 


"A IHR CAlKfS Or * 

M) 


operative 

(»i 


PRI'-APf HAZiPOS (3) 


* (Cent.) 

' 2) S 7 * S*2ar4!i.r 1 3 “ r .i 

(T.J.O) Mm. la Tx|.' 


Earliest opening of 
the cargo bJ/ ’S 
to deploy-en ,• :**e 
S/C and JUS/Tl*; into 
orbit. 

This mission phase will 
consist of tr« follow- 
tng elements: 

a Mission injection Is 
it (♦ • 9.3 rin.). 

OMS final after HECC, 

• Ear) iest opening of 
cario bay doors can 
be (♦ * 22 min. ), 

• Mission injection to 
APOGEE (reaches 
apogee at T * 35.9 

j «ln,). Apogee kick 
is in the first 
orbit (50 * 100 MILE 
orbit). 

• APOGEE TO CIRCULAR- 
IZATION! (8tn orbit). 

• Circularization to 

Predeployment Acti- 
vation and Checkout 
(♦ - 11 nrs, thi„ I 
opening of cargo bay 
doors. 1 

e Activation to pay- 
load deploy-ent 
(T * 11 hrs 40 min.) 


Intern mdi l.’jv throunh 

the 0ri<-ar, tin* -ill an! 

the outer ?<MX-«r.i**ctl 0 « 
snail . 

Secondary hazards rwlatM 
to dirpino Lf. through an 
IF- comatiblh lirl sy-.t** 
anil a non if ce-Mtible 
dunn Svstm. S*** en«ra- 
tion l. Mission ?nav» 1 
for definition of dump 
hazards. 


Intermediate leak through the 
orinary tank mil and the out*r 
leak protection shell. The nature 
Of th? inter-ediate leak changes 
with time; the lonqer the mission, 
the higher the pressure in the tan! 
and the greater distribution of the 
1*2 once it leaves the tank. At 
low pressure it will affect only 
local Items, but at higher pres- 
sures, the gas or 1 iguid will be 
more localized and travel further 
distances Such as water Cuming 
from a qarden hose except there 
will be a great deal A di spurs ion 
due to vacuum and zero *g M condi- 
tions. The chance o' a fire and 
the magnitude of a fire will 
increase as the pressure of the 
gas stream increases. Also as the 
pressure of the gas stream 
increases, the concentration of 
F, liquid or gas per unit area at 
volume Increases. 

The primary hazard could lead to 
larqer hazards as a result of the 
damage created by the primary 
hazard. 


In Saru* as th» first f‘»" 
reasons fpr 'Vin r ,t ! ■ I 
Mission Phase I 
?) Acceleration inaiis nr 
shock Mads to t**w 
toad dun co V*i sw.iri- 
t Ion . 

; 1 ) LOiMjor period of ti 

! f or leak -tin uh|T> t-. 

OCiur th.in iti* <<|fi- it • - r 
1, Mission Hb.ne 1. 


Eitern.il hj/arjv to 
the n.iylnjd, 

» Damage to the pay- 
load due to novinq 
Of payload and use 
of handling appara- 
tus. The tank may P< 
punctured or dfted 
when the payload !« 
handled remotely. 

■ Projected and 
explosive hazard 
from other pressure 
vessels on the S/C, 
IVS/TUC, or the 
orbiter. 


• Eiplosive hazard 
from sources other 
than pressure 
vessets. such as 
fuel cells, batter 
les, ignition of 
fuel/oxidizer M*- 
ture, etc. 

• Fire external of the 
tank. Could be 
caused by s«all leak 
!qn1 ing the he al 
coating Or igniting 
some fuel vapor that 
exists in the area. 

• Externa) corrosive 
fluids causing 
external corrosion 
of the tank and/or 
thermal coating. 


fOUJOtg^Ug / 


original page is 

OF POOR QUALITY 


V- D 3T3* 

f'urr-r.t Effects! 

Possihl* corrosi'.' :* orbiter In the 
cargo b*/. Due ‘ . ’ Nw'r pressure 
tne corrosion da*: *S probably U* 

tnan that during V ,J r> A ra t ion . 

Less chance of rn «.;•.* sm of moisture 
m the cargo ha/ • - * rrr nt beeauS" 
of the altttud-. ' * pressure in the 
cargo bay is lo» ; .«-ing this phas* of 
the mission. 

Creates a fire hif'd. if there 
is a fuel leak j* Vf sj'»- tn •• of 
tne fy leak, als ' Ignition source 
is needed, 'or t'- 7 1 IS hypergolic 
with nxjst fuels. 

(Delayed Effects) 

See Opcr. I, mss :r i f or effects 
of dump hazards. 


II oossible if a 
fire occurs or 
there is 4 fu*l 
vanor hazard at 

1 th* same ti-e the 
F. vapor hazard 
i exists. 


Sam* as fnr <V.-ratien I /’ll si 
low orblt*r ha/ *nvlrnnrv»nH 
(same as soar* wnylronr/wit M 
Assumed thit the f VA Salts! 
cnnnaMhle wit** F^. 

Orbiter ners .nnel al1«**djtl 
rAtm i hi/ during an wm»i( 
S/r certain' if,. 

|f l*.»V wmr. during thlsj 
S/C Mv.sinn -'ll! Sr cancel® 
orbital i*.ik nmmdure -fills 
ated (dunn nr denlnv S/C).l 
Shu It I* orbiter will COAtlffl 

orbit. 


U Possible O' I 
den-ndir.i oh th* 
reaction rate of 
F, with FVA y.’ITS 


II or 1 possible 


• The pa f load if 
depict'd in Fii 


Sa*»e as for Ooeratlon I 
Mission Phase 1, 

l^rcbabie 

I-nrobabl* 


- Ircredible 

- Irr-ttable 

- l ;rOtable 
M'.f'W # ro- *:ret 

J- X'ro.-J but 
*'?*te r cnance c* fire 
•-r:e of shrc-i. 


:!i?)ire - Incredible 


sre'e-rred * Incredible 
(Cent. ) 


’he likelihood for tM 
preferred and baseline 
system Is as follows: 
Saseline - improbable 


II, 

f risible 


ORB I TEJL PEPSCb'lEl. 

HTu rrtntTY feVt s 

• inpact on the '.r<- during this 
uhase of the nisi on. Possible injury 
to personnel let*' pn in th* mission 
If oersonnel were *M;1u1r*d to enter 
the camo bay du* to an ereroeoev. 
(Unlikely) 

(Delayed Effects) 

See Ooer, |, Miss' pn Phase 1 for ef- 
fects of dump K az»rd, 


(curre*”. effects) 

• The effects dur<*: the early part of 
the mission phase ’S not as qreat as 
In the latter pnses because the pres- 
sure rises in t*d tank with increase 
tn time. Also, •* the leak occurs 
during the early rhases of the mission 
there is wire ra to take corrective 
action to prote:* the orbiter. 


• Possible e*tens'.» damage to the 

orbiter Is thro.'-' corrosion or fire. 
When cargo bay t:*rs are open and 
when the payloa: -s being deployed 
the leak may ca,«- corrosion to the 
external surfaces of the orbiter and 
exposed optic*! a-d other viewing 
surfaces. 


e If a leak occurs the corrective action 
should be to re-m,e the payload from 
the orbiter be'*'* the planned time. 

If the propel U't were dtrped, 
extensive damn-.* to the orbiter may 
result. See le.el 11 hazard analysis 
on the hazards using the baseline 

dump system. 


• Possible react':’ with other 

materials and # .«ls on the 5/C and tug 
rius'nq Mrge’ Hoards to occur which 
may cause thr c* jiztr t*nk to 
-upture which -:^ld cause extensive 
innediate da*a:« to the orbiter. 


• The baseline system only 
partial shro.d (covert t 
electronics only), 

• There is no system on |fi 
that could control an F> 
control the corrosion ©r 

• ho F, detectors for dele 
concentrations in the |a 


a Another shuttle launch c( 
instituted to rescue ftfi ■ 
orbiter. 


• This is a nonvented o*J 
system. 


Basel ine - Ixcftdiblt 


Preferred - Incredible 
(due to the outer 
shroud enclosing the 
complete S/C). 


Qaseline - Ix^robable 
(Hjst conside- that 
there is wore thar one 
oressure vessel that 
could caul* the problem 
Preferred - Incredible 
Shroud protects from 
vest pressure vessels.)* 
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IHUTTLE/ORBITER PRIMARY HAZARD ANALYSIS FOR TASK 5 


hjwm rrnrrs ^ vwtuf nowi* 


SAFETY CMUttlt l (11) 


wrw»f 

( 10 ) 


asm j r[ f 

Chirr* nt fffncts) 

Mo eff*t<t on t*»«* ori.i t«*r b»tJi .* 
tn<» F., va"or is isolated fn>* th. 
ortut»r carnn bav. 

Possible byrn through of shroud 
OP OV** prwXSori ;<lt Ion of Shroud 
allowing or. .»nrf/or omlottUe-, 
to two \ no« on the careo hiv 


San* . 1 % fop Afy* r jtlon I/*Mss1nn Phis* I 
I Oh OPbH*r bar *nvlmnmnntal nrov.ur* 

( KDTV' 4S StW* •nytronP'Hit) 

Assured that tV FVA Suits ar* not 
comarlhlg with F^. 

Arbiter i*rswn*1 allo^d to ""ter the 
rirnn biy 'lurloo A" nmnrnencv when 
V r . cunt a in* If,. 

rf I •«!' t HCurs i during this n*i«», too 
VC H i s *• ton -111 bo CAncnllp'l. fin 
orbital 1 04 * irorHttf* will v* In 1 1 1 - 
•ted (itunn nr Oonloy S/C). Th* 
shuttle orbltop Hill continue to 
OPftlt. 


Uhl* If 4 
torn or 
t% a tu* 1 

Ward At 


'AoljVOrt fffer.ts) 

Sr* Oner. I, Mission Pha r * I, 

" IntrmodI *t* I'M* - fop I'tdlil'fl 
4 1 information. 


fWniTEP persammu 
fCurrnnV EffVct’O 
Ho 1 react . 
(Delayed Effects) 
•o Impact 


1 enssibl' 


Orbltep 

(Current Effects) 

There should be no current effects 
I for the shroud should contain the 
leaklnq vapors. NOTE (I). 

(Delayed Effects) 

No direct effect on orbiter during 
early phases of this mission because 
of capability to off-load the propel) 
lant either by dumping, venting or 
deploying the payload. 


• The payload System design Is that 
deolcted in Fiqure (TBO). 

• The baseline system only has a 
partial snroud (covers the 
electronics only). 

• There is no system on the orbiter 
that could control an F? fire or 
control the corrosion of the IF.. 


• no F, detectors for detecting gas 
concentrations in the cargo bay. 


« Another shuttle launch can fce 
instituted to rescue an disabled 
orbiter. 


During later phases of the mission 
particularly if an extended mission 
occurs, and after the dump line Is | 
disconnected, the risk to the orbitei 
increases, but due to the snail 
amount of time the payload is nor- | 
nally in this mission phase, probabl; 
little damage would occur to the 
orbiter from the primary hazard. 
Damage may occur as a result of a 
secondary hazard which would be the 
F 2 gas venting from the oxidizer 
tank as the pressure In the tank 
increases. The gas could cause 
corrosion of external surfaces of 
the orbiter. 


• This is a nonvented oxidizer 

system. 
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MARINER/Si 


OPERATIONS 

0 ) 


I 

3A 

(Cont.) 


MISSION 

PHASE 

( 2 ) 


Mission injection to 
deployment. 

(cont. ) 


• Payload deployment 
to S/C/TUG checkout 
release, and tug 
activation. 

(+ s 11 hrs 60 min. 


• S/C/TUG activation 
to orbiter- 
separation and tug 
initial burn 
(+ = 11 hrs 
100 min.). The 
orbiter-separates 
about 100' and a 
line-of-sight view 
of the orbiter is 
maintained. 


PRIMARY 

HAZARDS 

(3) 


i) Intermediate leak (continued). 


MAJOR CAUSES 
OF HAZARDS 
( 4 ) 


A) External hazards 
(cont. ) 


Failure to discon- 
nect all appropri- 
ate 1 ines and 
connections to the 
orbiter before 
deployment of the 
payload into its 
orbit, (e.g., the 
dump line may be 
inadequately 
disconnected. 


Interference with 
fixed objects and 
structures when 
moving the payload. 


Thermal shock to 
orbiter before the 
orbiter can 
separate from the 
payload. 


Inadvertent vent- 
ing of the oxidizei 
tank when the 
cargo bay doors are| 
open and closed. 


• Damage to tank 
from ordnance 
devices. 


Damage to tank from 
personnel durinq 
IVA and emergency 
condi ti or IVA 

may be required to 
deploy the payload 


Damage to the tank 
from mechanisms 
used to take off 
thermal coating. 


Inadequate heat 
transfer through 
the thermal coating 
causinq early 
rapid pressure 
rise. 


LIKELIHOOD OF 
HAZARD CAUSES 
( 5 ; 


Baseline - Improbable 


Preferred - Improbable 
Baseline - Improbable 


Preferred - Improbable 
Baseline - Improbable 


ARC 


Basel ine - Incredible 
Preferred - Incredible 


Baseline - Improbable 


Preferred - Incredible 
because of shroud 
protection. 


Baseline - Improbable 


Preferred - Improbable 


Baseline - Improbable 


Possib^ 
termi ni 


No i ,T *nedi 
because aj 
remote 1 J 


Preferred - Improbable 
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^RINER/SHUTTLE /ORBITER PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 

LEVEL I ANALYSIS 


EFFECTS lii "PRESENT ' 
E SYSTEM AND FACILITIES 
( 6 ) 


"PRESENT- 

RISK 

CATEGORIES 


"PRESENT 0 SAFETY CONTROLS 
AND ASSUMPTIONS tQ * 



RISK 

CATEGORY 

( 10 ) 



Orb it er (c ont . ) 

(Delayed Effects) 

• Posbible-crash landing and early 
termination of the mission. 


Orbiter Personnel 


(Current Effects) 

No immediate impact, on personnel 
because all operations are performed 
remotely. 


II 

I possible 


II 

I possible 


(Delayed Effects) 



Orbiter Personnel 
(Current Effects) 


No effect 

(Delayed Effects) 

Possible toxic and corrosive gas 
hazard in cargo bay and could cause 
damage to IVA suit and injury to 
personnel if IVA was attempted. Also 
some hazard to personnel and equipment 
during any EVA performed. Also 
possible injury to personnel in 
orbiter if hazard propagates to a 
larger hazard when an extended mission 
occurs or for some other reason for 
causing tne oxidizer tank to over 
pressurize. 


• Toxic;qj 
in the! 

• Protect 
corrosil 


III 

II possible 


POLDOtrt FRAMJj] 






STEM 


RISK 

CATEGORY 

( 10 ) 


SAFETY 

CONTROLS & ASSUMPTIONS 

(ID 


'?) 


• Toxic gas detection system required 
in the carqo hay. 

IV • Protect optical surfaces from K 

corrosion. 


( gas III 

d cause II possible 

'y to 

:ed. Also 
i equipment 
Uso 
I in 
i to a 
ied mission 
ison for 
3 over 




OPERATION 

0 ) 


I (ContJ 
3B 


MISSION PHASE (2) 


Deployment of the pay- 
load from the orbiter 
after an unplanned 
mission extension. 
Assumed that the F 2 
dump system has been 
disconnected. 


PRIMARY HAZARDS (3) 


Explosive ruoture of the 
oxidizer tank due to hi ah 
internal tank oressures. 


MAJOR CAUSES OF HAZARDS 

(4) 


o Same as for intermediate 
leak durinn ©Deration 3A. 

o Mainly because of heatino 
of the tank due to the 
extended time without 
coolent. 


LIKELIHOOD OF 
CAUSES 

( 5 ) 


7APD 


See ooeration 3A. 

Baseline System : because 
there is no vent and if 
the leak before burst 
(see Fiq. TBD) failure 
mode doesn't work as 
intended, there is a 100; 
chance the tank will rup- 
ture if the Pressure rise 
is nivei sufficient tine. 
The chance of a major leal 
or ruoture will depend on 
the time available to re- 
move the tank thermal 
coatinq and subject it to 
space temperatures and 
coc-1 down so that the 
pressure can be safely 
contained. 

Perferred System : The 

chance of this tank ruo- 
turinn is " incredible* 
beca/se of the leak-befon 
burst *esiqn nhilosoohy 
and the use of a vent 
system as indicated in 
Fiaure ( ) 


HAZARD EFFECTS ON 

( 6 ) 


O RBITER 

TCurrent Effects) 

The orbiter may b« sev 
disabled if this hazard 
major leak occurs (tanlg 
there will be signified^ 
the propogation of the 
TUG and other oarts of 
orbiter. 


(Other Effects^ 

Because of the nature o 
effects no other effec" 
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FLIGHT PRIMARY HAZARD ANALYSIS FOR TASK 5 AND 6 


CTS ON SHUTTLE ORB I TER 

( 6 ) 


RISK CATEGORIES 

( 7 ) 


SAFETY CONTROLS A ASSUMPTIONS 

(8) 


HAZARD EFFECTS ON SHUTTLE ORBITER 

( 0 ) 


RISK CATEGORY 



may be severely damaged and 
this hazard occurs. If a 
occurs (tank just splits open) 
oe significant damage due to 
tion of the hazard to the I US/ 
3r parts of the S/C to the 


the nature of the current 
other effects are considered. 


ORBITER ORBITER 

(Current Effects) 

0 ’ f0r deSCrlDti0n 0f If hazard occurs, it win bo a low 

baseline system. nrder ru[)ture an(J because Qf th? 

. s„ ... ci. «) «*,.«.«, 3 a of 

. ». ,.n, X S SfSS SIC"""" 


IV 

II possible 


o Tank designed to leak before burst. 


(nelaved Effects) 

Possible corrosion to external sur- 
faces of the orbiter due to leaking 
of oases through the shroud or 
oossible exolosion resulting in 
leaks throuah the shroud. Could 
cause corrosion of ootical surfaces 

ORBITER PERSONNEL 
(Current effects) 

None because of shroud. 

{Delayed Effects) 

If EVA or IVA reouired, damages to 
snace suits nay result. Also cor- 
rosion of ontical surfaces mav 
cause injury of astronauts (corro- 
sion of soace suit helmet view 
part). 


III, I! possible 


o See Figure ( 
perferred 

o Same as for 
3A above. 

o Vent system 
to leak befo 


o The vent mu 
electrical 1/ 
be opened du 
pressures. 

o The dump 1 in 

o The shroud i! 


111,11 possible 


r 


I 









UTTLE 0RB1TER 


SAFETY CONTROLS & ASSUMPTIONS (11) 


will be a low 
tause of the 
should be 

amount of 
oronel lant 
tem. 


RISK CATEGORY 

( 10 ) 

IV o See Figure ( ) for description of 

II possible perferred system. 

o Same as for Col. (11) of operation 
3A above. 

o Vent system provided or tank designed 
to leak before burst. 


ITT TT r « e4Klfl o The vent must be designed to be 

* ^ electrically opened or to automatically 

5 external sur- be opened due to high internal tank 

due to leaking pressures, 

shroud or 

ssultinq in 0 jh e dump line is disconnected. 

'*oud. Could 

Jtical surfaces o The shroud is vented. 


111,11 possible 

id. 


sd, damages to 
It. ^lso cor- 
•faces mav 
mauts (corro- 
ilmet view 











OPERATIONS 

0 ) 


Normal 

Mission 


MISSION 

PHASE 

( 2 ) 


Unscheduled S/C 
Propellant off- 
load during mission 
Phase 1 . 

The only mode for 
off-loading during 
this mission phase 
is to dump propel- 
lant through the 
orbiter dump system 


HAZARDS (3) 


1) Interme- 
diate leak 
through the 
primary oxi- 
dizer tank 
wall and the 
outer leak 
protection 
shel 1 . 

2) Other 
primary haz- 
ards that 
required off 
loadinq of 
propel lant. 


FLIGHT SE 





SECONDARY 


1) LFp and F, gas and 
other possible toxic 
byproducts escaping 
from the off-load 
system into the 
orbiter caroo bav 
or other portions 
of the orbiter such 
as the main engine 
space. 


MAJOR CAUSES OF 
HAZARDS (SECONDARY) 
(4) 


• Contaminated off- 
load s vs tern. 

• Incompatible 
materials of off- 
load system. 

• Moisture in the 
off-load system. 

• Inadequate joints 
in the nlDinq. 

• Inadequate desiqn 
of the off load 
system. 


LIKELIHOOD OF HAZARD 

Cfl, ffS» t.:2 


Baseline Preferred 


HAZARD EFFECTS ON SHUTTLE 
ORBITER 
( 6 ) 


ORBITER 1 

( Curren tfTTfects ) 

§ Possible extensive corrosion 
and low order explosions if. 
occurs in the rain engine spa 
there are fuel vapors in t‘»a 
also, the effects of the baza 
significantly greater. 


(Delayed Effects) 

Additional damage to orbiter: 
additional time for corrosloi 
RTLS or continue to orbit wii 
implemented. The risk of daq 
propagation is less for the J 
parts of the mission because 
hazardous propellant has bee 
loaded. Need to perform stud 
determine if it is better to 
to orbit or RTLS. 

ORBITER PE RSONNEL 
(Current i ff e c tsT ’ 

• No immediate effect on orb’t 
sonnel up to SRM separation.^ 

• The effects will probably be e 
ienced immediately after SRM 


L 


(Delayed Effects) 


If the orbiter cannot be broU 
back to earth safely as a re^j 
of the damage incurred* the | 
of the crew are endangered, 1 
lally if they cannot conti nu 
orbit and space rescue cannot 
performed. Also any leaks in 
the cargo bay area presents | 
possibility of corrosion of 4 
EVA & IVA suits. 


2) Explosive Reaction 1 
the off-load system. 


• Contaminated off- 
load system. 

• Inconoatlble materi 
lals of off-load 
sys tem . 

• Water vaoor in off 
load system. 

• Fuel vaoors in off 
load system 


| Baseline 

ImpXCred* 

Improbable 


Preferrei 

Impxlmp* 

incredible 


ORBITER 

(Current Effects) 

Possible major damage to engine | 
and can be the cause of major exa 
sions & fires in the engine spaced 

(Delayed Effects) 

Because of the extent of damage d 
Phase 1, the orbiter probably wo ? 
be able tc enter into Phase 2. 


ORBITER PERSONNEL 


It Is very possible the orbiter w 
be damaged to the point that the 
would not survive because of inabij 
to re-enter safely. 

(Oelayed Effects) 

Same as orbiter delayed effects. 


S<i*. 
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• fECONDARY HAZARD ANA'.YSIS FOR TASK 5 AND 6 


SHUTTLE/MARINER BASELINE SYSTEM 


UTTLE 


RISK CATEGORIES 
(7) 


safety controls Arm assumptions (r) 


r os ion, fire 
ns if the leak 
ine soace. If 
in the area 
}\q hazard are 


) 

trbiter due to 
;rrosion of F~ 
•bit will be c 
; of danane 
>r the later 
>ecause the 
las been off- 
>rm study to 
tter to contin 


:L 

>T 

n orbiter per- 
ration. 

ily be exper- 
ter SRM bum. 

O 

be brought 
as a result 
d, the lives 
jered, espec- 
continue to 
e cannot be 
leaks into 
esents the 
Ion of the 


engine space 
ajor explo- 
ne space. 


damage during 
ably won't 
se 2. 


rbi ter would 
hat the crew 
of inability 


ffects. 


II* I possible 
(loss of orbiter) 


II 


IV 


I or II possible 


• The baseline desinn is as is depicted in 

Finure ( ). OMS kit hyoeroolic dump. 

• No vent system is provided for the 
oxidizer tank. 

The normal orbiter hvnernollc dumn sys- 
tem is used. The LF, would off-load 
throunh the IUS/Tuo then through thn 
orbiter dump nioino which nasses 
through the engine *oace. 


II, I Possible 


• Same controls as above. 


SHUTTLE/’IARihER PERFEPRFD SYST fM 


r r;j i crr c c. ra 


HAZARD EFFFCTS ON shuttle obiter 
(9) 


ORBITER 

(Current Effects) 

Possible corrosion eouiomgnt in the 
«* 4 in engine soace and carno ha* 
but not near the amount 
would occur in the baseli.. _im. 
Possible fire for sm^ll neri.»d of 
time. Will orobahlv go out ien 
approaching SRM s*oaratior , due to 
low pressure. 

(Delayed Effects) 

Possible additional corrosion durlw 
later mission phases bet will be 
minimal due to vacuum conditions an< 
low "q" forces. Also th> LF ? has 
been off-loaded so t'.c total 'poten- 
tial hazard is significantly reduce* 

DRIB ITER PERSONNEL 
(Current Effects) 

No effects 

(Delayed Effects) 

Any residual F- gas or HF gas in 
cargo bay may 6i a hazard to the 
suits of astror auts during IVA 
when the carno hav doors are 
closed or when thev are first 
opened. Also hazardous vapors 
may still exist after payload is 
deployed & doors are closed. 


RISK 

CATEGORY 

( 10 ) 


III* II poss- 
ible but not 
likely. 


HI 


IV 


II 


(damaae to the 
IVA suit) 


ORBITER 

(Current Effects) 

If an explosion Is experienced it 
*111 probably only be a low order 
“xplosion and it is very likely 
the off-load system will contain 
the LF-. Although some r 2 leakage 
[nay occur and cause some corrosive 
(damage. 

(Delayed Effects) 

[Same as orbiter delayed eff r .cs 
[for secondary hazard No. (1) above. 

ORBITER PERSONNEL 
(Current Effects) 

No effect up to SRM separation. 

(Delayed Effects) 

( robably no Injury to personnel 
ecause of orbiter alert capability 


III, II possible 
(cost of damage) 


III 

IV 

IV 


SAFETY CONTROLS & ASSUMPTIONS 
(H) 



Put safety controls below into this soace 


• Assure that the carno bay is free of 
all gas before IVA is allowed. 

p Assure the off-load Is prooerly passi- 
vated and sealed before launch of 
the orbiter. Assure all joints in 
the off-load system are leak free 
before launch. 

o Route piping In the orbiter such that 
there will be minimum damage ; f a 
hazard occurs. 

o Keep pressures in the off-load system 
law. 

o Minimize off-load time as much as 
possible. 

o Assure there are no pockets in the off- 
load piping so that no LF- will be 
left in piping after offloading. 

o Assure the off-load sys. Is Isolated 
from all sources of fuel vapor hazards. 

o Require an outer shell around tne off- 
load piping. 

o Design off-load piping with a high 
safety factor, e.g. 3.0, when the 
temperatures in the off-load piping 
are at a maximum. 


Same as **+ hazard (1) above. 

• Assure the off-load i- properly passi- 
vated and scaled before launch of the 
orbiter. Assure all joints in the off- 
load system are leak free before launch. 

• Route piping in the orbiter such that 
there will be minimum damage if a hazard 
occurs. 

• Keep pressures in the off-load system 
low. 

• Minimize off-load time as much as 
possible. 

• Assure threr are no pocket in the off- 
load piping so that no LF 2 will be left 
in piping after off-loading. 

• Assure the off-load system is isolated 
from all sources of fgel vapor hazards. 

[• Require an outer shell around the off- 
load piping. 

!• Design off-load piping with a safety 
factor of 3.0 when the temperatures In 
the off-load piping are at a maximum. 
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SMUTTlE/WRIflEP PERFECT) SYSTF 


;CTS ON SHUTTLE CWTER 
(9) 


ORBITER 
»nt ffTncts) 

rroslon eguinment in the 
space and cargo bay 
r the amount that 
In the baseline design . 
re for small neriod of 
orobablv no out ien 
SRM s<*oarat»or , due to 
e. 

aved Effects) 

dltional corrosion durinn 
on nhases but will be 
to vacuum conditions and 
ces. Also the LF~ has 
aded so the total Soten- 
is significantly reduced 


HER PERSOY IEL 
irrenTTfFectsT 


•layed Effects) 
tl F- gas or HF oas in 
lay oe a hazard to the 
■ troncjts durfnq IVA 
irao oav doors are 
<hen thev are first 
Iso haza r dous vaoors 
»xist after oayload Is 
doors are closed. 


ORB ITER 
rent Effects ) 

sion is exoerienced it 
ly only be a low order 
nd it Is very likely 
d system will contain 
Itnoug*’ seme leakage 
nd cause some corrosive 

ayed Effects) 

iter delayed effects 
ry hazard No. (1) above. 

TER PERSONNEL 
rent Effects) 

0 to SRM separation, 

ayed Effects) 

injury to personnel 
orb iter alert capability. 


RISK 

CATEGORY 

( 10 ) 


HI. II poss- 
ible but not 
likely. 


Ill 


IV 


il 

{damaae to the 
IVA suit) 


SAFETY CONTROLS & ASSUMPTIONS 


PI ’ARKS 


OD 


( 1 ?) 


Put safety controls below Into this snace 


• Assure that the cargo bay is free of 
all F^ gas before IvA is allowed. 

X) Assure the off-load Is orooerly passi- 
vated and sealed before launch of 
the orbiter. Assure all joints In 
the off-load system are leak free 
before launch. 

o Route piping in the arbiter such that 
there will be minimum damage if a 
hazard occurs. 


Note 1 : 

The hazards that are Inherent in the S/C removal method of off- 
loading the prooellant are analyzed in the lev»l I Hazard Analysis 
Operation (TBh), Mission Phase (TRO). 

Note ?,: 

The likelihood of the causes of hazards is highly dependent on 
the nature of the system design and the procedure used on the 
nroaran. 

Note 3 : 

To lower these risk categories without using the oerferred system, 
major modifications would be r^guired to the Present orbiter dumo 
.svstem and much more strlnqent procedures would have to be 
Imolemented. 


o Keep pressures In the off-load system 
low. 

o Minimize off-load time as much as 
possible. 

o Assure there are no pockets in the off- 
load piping so that no LF 2 will be 
left in piping after off-ioading. 

o Assure the off-load sys. Is isolated 
from all sources of fuel vapor hazards. 

o Require an outer shell around the off- 
load piping. 

o Design off-load piping with a high 
safety factor, e.g. 3.C, when the 
temperatures in the off-load piping 
are at a maximum. 


CONCLUSION 


If a bump system is used It must be designed for flouring. 


Ill, II possible 
(cost of damage) 


III 

IV 


IV 


|Same as for hazard (1) above. 

' Assure the off-load is properly passi- 
vated and scaled before launch of the 
orbiter. Assure all joints in the off- 
load system are leal free before launch. 

• Route piping in the orbiter such that 
there will be minimum damage if a hazard 
occurs. 

• Keep pressures in the off-load system 
low. 

• Minimize off-load time as much as 
possible. 

• Assure threr are no pockets in the off- 
load piping so that no LF£ will be left 
in piping after off-loading. 

• Assure the off-load system is isolated 
from all sources of fqel vapor hazards. 

• Require an outer shell around the off- 
load piping. 


• Design off-load piping with a s fety 
factor of 3.0 when the temperatures in 
the o f f-load piping are at a maximum. 


K)U)OiS 

-u 
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Normal 

Mission 


OPERATIONS 

( 2 ) 


1) Unscheduled S/C 
Propellant off-load 
during Mission Phase 


HAZARDS (3) 


SECONDARY 


3) Hazardous LF ? and F- 
aas and other toxic; 
corrosive and flamm- 
able byproducts that 
flow from the exit of 
the oropellant off- 
load system. 


MAJOR CAUSES OF 

LIKELIHOOD OF HAZARD 

HAZARDS 

CAUSES 

(4) 

(5) 

• Exists auring 

• Always occurs when the 

normal off- 

baseline or the nerfer- 

load operations. 

red off-load s vs tern is 
used, if system pron- 


erly deslqned improbable 
x improbable « incredible. 


HAZARD EFFECTS ON SHUTTLE ORBITE 
( 6 ) 


ORBITER 

( Current Effects ) 

Possible corrosion of external ori 
surface or back work of 9 as 
main enqine space causinq 

corrosion. * 
amount of damaqe will depend on t 
amount of F- vapor back-washed in 
the Shuttle^Orbi ter at various lo 
Also possible reaction with main 
combustor products. 


(Delayed* Effects) 

None unless all propel lar.t can‘t 
dumped before SRM separation. Thei 
should be no danaqe to the orbited 
bay because it is out qassinq dur 
mission Phase. 


ORBITER PERSO NNEL 
(Current EfFec t $T” 

No effects on Orbiter Personnel 


(Delayed Effects) 

flo effects on orbiter personnel a 
SRM separation because tne orbite 
Has left all the dumped LF 9 behin 
It is assumed that the cargo bay 
be venting gas from the bay afte 
LF ? is off-loaded. 




MECO to earliest 
cargo bay doors 
can be opened (T 
22 min). Occurs 
after first OMS 
burn. 


Same as for 1) 
Mission 
Phase I. 


LF 2 and F2 gas and 
other toxic by- 
products escaping 
from the off-load 
system into the 
orbiter cargo bay 
or other portions 
of the orbiter such 
as the main engine I 
space. 


Same as for Mission IMPROBABLE 
Phase I. 


ORBITER 

(Current Effects) 

Same as for Mission Phase I; 
Secondary Hazard (1). 


(Delayed Effects) 

Generally the sane as for Mf, 
Phase I, Secondary Hazard (Tj 


ORBITER PERSONNEL 
(Current Effects) 

No injury to personnel, fo 
personnel not exposed to th 
hazard. Also personnel will 
be injured during this phas 
to a damaged orbiter. 

(Delayed Effects) 

Possible injury to personn 
they enter the cargo bay in 
suits and the suits are danj 
by F2 vapors that are in til 
even after the cargo bay do 
open. 


FOLDOUTjT RAMfl I 







FLIGHT SECONDARY HAZARD ANALYSIS FOR TASK 5 AND 6 


SHUTTLE/MARINER BASELINE SYSTEM 


HAZARD EFFECTS ON SHUTTLE ORBITER 

( 6 ) 


SHUTTLE/^’ NER PERFERRED SYSTEM 


RISK CATEGORIES 

SAFETY CONTROLS AND ASSUMPTIONS (R) 

HAZARD EFFECTS ON SHUTTLE ORBITER 

RISK CATEGORY 

SAFETY CONTROLS 8 

(7) 


(9) 

(10) 

iHHIH 


ORBITER 

(Current Effects) 


Possible corrosion of external orbiter 
surface or back work of F- gas into the 
nain enqine space causing* 

corrosion. The 
amount of damage will depend on the 
amount of F 2 vapor back-washed into 
the Shuttle^Orbi ter at various locations, 
Mso possible reaction with main engine 
combustor products. 


(Delayed* Effects) 


Mone unless all propellant can't be 
dumped before SRM separation. There 
should be no damage to the orbiter carqo 
bay because It is out gassing during this 
mission Phase. 


ORBITER PERSONNEL 
(Current Effects) 


Mo effects on Orbiter Personnel 


(Delayed Effects) 


io effects on orbiter personnel after 
5RM separation because the orbiter 
las left all the dumped LF ? behind. 

[t is assumed that the cargo bay will 
>e venting gas from the bay after the 


.F 2 is off-loaded. 


IV 


IV 


IV 


The outlet point of the off-load 
system is the same as for the normal 
shuttle propellant dump system. 


ORBITER 

(Current Effects) 


Do not dump during re-entry when 
recirculation condition can exist. Dump 
only during ascent or on orbit. 


Do not dump prior to liftoff. 

Cargo bay vents are closed at liftoff. 


Possible corrosion to the orbiter, 
but less than the base-line system 
because of the ootimum location of 
the outlet of the off-load system. 

(Delayed Effects) 

No effects after SRM seoaration 


ORBITER PERSONNEL 
(Current Effects) 


No effects. 

(Delayed Effects) 

No effects after SRM seoaration. 


ORBITER 

(Current Effects) 


Same ar» for Mission Phase I, 
Secondary Hazard (1). 


(Delayed Effects) 


Generally the same as for Mission 
Phase I, Secondary Hazard (1) 


ORBITER PERSONNEL 
(Current Effects) 


No injury to personnel , for 
personnel not exposed to the 
hazard. Also personnel will not 
be injured during this phase due 
to a damaged orbiter. 


(Delayed Effects) 


Possible injury to personnel if 
they enter the cargo bay in space 
suits and the suits are damaged 
by F2 vapors that are in the bay 
even after the cargo bay doors are 
open. 


Ill 


IV 


IV 

IV 


II 


II 


III, 

II possible 
(breathing toxic 
vapor ) 


NOTE 2: Assumed that there is no means 
available to blow out toxic vapors in the| 
Cargo bay when in orbit. 


ORBITER 


(Current Effects) 

Same as for Oper. I, Mission 
Phase I, secondary hazard 1. 
Possible continuing corrosion in 
the Main engine space after MECO 
due to left-over F? gas. 

(Delayed Effects) 

Possible continuing corrosion 
of equipment in the Main 
engine space from F2 which leaked 
into or back washed into the engine 
space. 

ORBITER PERSONNEL 
(Current Effects) 

No Effects 


(Delayed Effects) 


Same as for Oper. I, Mission Phase 1,| 
Secondary hazard 1 . 


Ill 


IV 


II 

(damage to 
the IVA suit) 


c-y 


HOLDOUT 


cjRAia 2^ 


Assure that the 
system Is locate 
of f 2 gas will 
minimi zed. 

Do not dump durl 
recirculation ci 
Dump only durinj 

Do not dump pri 
Cargo bay vents 


Use piping v/i til 
payload umbilici 
at the bulkhead 
space. It woul<ffl 
all welded join 

Provide an F 2 d 
bay so that it wl 
F 2 gas hazard ex| 
detector in the 
so that inclpi 
detected. 


There is no 
Main engine spaq 

Assure that the 1 
of F 2 gas befOH 









VASK 5 AND 6 


SHUTTLE/MARINER PERFERRED SYSTEM 


RO EFFECTS ON SHUTTLE 0R3ITER 

(9) 


RISK CATEGORY 

(10) 


ORBITER 

(Current Effects) 

ible corrosion to the orbiter, 
less than the base-line system 
jse of the ootimum location of 
jutlet of the off-load system. 

(Delayed Effects) 

Ffects after* SRM seoaration 

ORBITER PERSONNEL 
(Current Effects) 

Ffects . 

(Delayed Effects) 

Ffects after SRM seoaration. 


III 

IV 

IV 

IV 


ORBITER 

(Current Effects) 

js for Oper. I , Mission 
I. secondary hazard 1. 

>le continuing corrosion in 
lin engine space after MECO 
) left-over F 2 gas. 

(Delayed Effects) 

)le continuing corrosion 
ilpment in the Main 
i space from F 2 which leaked 
>r back washed into the en^’ne 

ORBITER PERSONNEL 
(Current Effects) 

'ects 


(Delayed Effects) 

s for Oper. I, Mission Phase 1, 
ary hazard 1. 


Ill 


IV 


II 

(damage to 
the IVA suit) 


SAFETY CONTROLS & ASSUMPTIONS (11) 


t Assure that the outlet of the off-load 
system Is located so that the back work! 
of Fo gas will be eliminated or 
minimized. 

• Do not dump during re-entry when 
recirculation condition can exist. 

Dump only during ascent or on orbit. 

• Do not dump prior to liftoff. 

• Cargo bay vents are closed at liftoff. 


Use piping with no joints from the 
payload umbilical to the connection 
at the bulkhead in the main engine 
space. It would be desirable to use 
all welded joints. 

Provide an F 2 detec’tor- in the cargo 
bay so that it will be known if a 
F 2 gas hazard exists. Provide a 
detector in the S/C shroud also, 
so that incipient leaks may be 
detected. 

There is no means to purge the 
Main engine space. 

Assure that the Cargo bay is free 
of F 2 gas before IVA is allowed. 


PAGE 6 OF 9 


REMARKS 

( 12 ) 


NStralaht foreward desian oroblem. 


NOTE 1: The only allowed off-load made during this phase is 
to dump and not deploy the payload into orbit. 
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FLIGHT SECOND 


SHUTTLE/MARINER BASELINE SYSTEM 


OPERATION 

(D 


HAZARDS (3) 



MAJOR CAUSES 
Or HAZARDS 
(4) 


LIKELIHOOD OF 
HAZARD CAUSES 
(5) 


HAZARD EFFECTS OH 
SHUTTLE ORB1TER 
( 6 ) 


RISK 

CATEGORIES 

(7) 


Same as Mission Phase Same as for 2) Explosive reaction 
(2) above. Mission In the off-load 

Phase {!). system. 


iame as for Oper.1,1 Same as for Oper. I* 


■lission Phase (1) 
Secondary hazard 
( 2 ). 


3) Hazardous LF 2 and F2 
gas and other toxic 
corrosive and 
flarauable products 
that flow from the 
exit of the pro- 
pellant off-load 
system and due to 
vacuum condition 
and zero "g" form a 
cloud on or near the 
orbiter. Also toxic 
gas cloud presents a 
hazard to the orbi- 
ter in other orbits 
when the dispersion 
is sufficient to 
lower the concen- 
tration to an 
acceptable level. 


Mission Phase ( 1 > * 
Secondary Hazard (2) 
above. 

PASELINE * IMPROBABLE X 
CRFDIBLE « IMPROBABLE 


o The LF 2 or F2 
gas always 
exists during a 
normal dump 
operation. The 
formation of the 
cloud around the 
orbiter depends 
on the condition 
at the time of 
the dump. The 
initial rebare 
of F 2 will flow 
a large distance 
away from the 
orbiter. but the 
direction of the 
gas cloud flow 
depends on the 
design of the 
exit nozzle. 


The existence of 
gas hazard always occurs 
when the gas is dumped. 
The chance of enveloping 
the orbiter with toxic 
gas is small and depends 
an the orbital condition 
and the design of the 
exit n02zle and the 
location of the nozzle. 

(IMPROBABLE) 


(Current Effects) 

Possible major damage to the engine 
space due to low-order explosions. 

Also major corrosion to the orbiter 
cargo bay. 

(Delayed Effects) 

Continued corrosion of the Main engine 
space and orbiter cargo bay due to F2 
left over in the areas due to the inci- 
dent. The effect on reentry capability 
is not known at this time. 

ORBITER PERSONNEL 
(Current Effects) 

Possible major injury to personnel but 
not likely because the incident happens 
when the orbiter is going into orbit. 

If orbit couldn't be achieved, AOA 
would have to be attempted. 

(Delayed Effects) 

Possible damage to Space Suit and 
injury or death to personnel in suit 
if individual enters cargo bay when 
high concentration of toxic Vdpor 
exists. Also possible death due to 
failure to reenter atmosphere safely. 


ORBITER 

(Current Effects) III, 

Same as for Oper. I, Mission Phase 0), 

Secondary Hazard (3). depend) n 9 on 


III. 

II possible 


II. 

I possible for 
whole crew 


location and 
design of exit 
nozzle. 


(Oelayed Effects) 

Possible Injection of toxic vapor in 
cargo bay causing corrosion of equip- 
ment. Depends on the pressure in 
cargo bay atmosphere, and location and 
design of nozzle. Also orbiter may 
pass through the toxic and corrosive 
gas cloud on another orbit. 

ORBITER PERSONNEL 


(Current Effects) 

If toxic and corrosive F? gas is 
in jested into the cargo bay, a hazard 
to the personnel space su'.ts will exist 
and there by prevent a possible chance 
of injuring to personnel n the suits. 

(Delayed Effects) 

Sams as for current effects. 


Ill, 

II possible 


<)LD 0 U^JjR 41 fl( 


ORIGINAL PAGE IS 
OF POOR QUALITY 











J 


:OND;\RY HAZARD ANALYSIS FOR TASK 5 AND 6 


i 


SHUTTLE /MARINER PREFERRED SYSTEM 


SAFETY CONTROLS 
ANO ASSUMPTIONS 
( 8 ) 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
(9) 


RISK 

CATEGORY 

OO) 


SAFETY 

CONTROLS & ASSUMPTIONS 

on 



o Same as for Secondary Hazard (1) 
above. 


Provide Fg vapor detection In the 
cargo bay area before emergency 
entry allowed. 


ORBITER 


(Current Effects) 


Same as for Secondary Hazard (1) 
and (2) above. 


Same as for Secondary Hazard (2) 
above. 


Design of off-load sys and S/C is 
depicted In Figure (TBD). 


Provide overpressure relief valve 
for the orbiter cargo bay. The 
normal vent system may be 
adequate. 


NOTE 1: The F 2 will be dumped into essentially a vacuum 
condition will exist. The cargo bay atmospher 
essentially a vacuum. The orbiter will be act 
part of the time due to the OMS engine burn. L 
gas will be vented under pressure. 


The resistance of the cargo bay 
structural systems (shuttle structure) 
are very sensitive to excessive over 
pressure that may occur In the cargo 
bay. Over pressures may cause exten- 
sive damage to the structure of the 
orbiter. Could possible prevent 
reentry. 


(Delayed Effects) 


Same as for Qper. I, Mission Phase 
(1), secondary hazard I above. 


ORBITER PERSONNEL 
(Current Effects) 
No effect 


(Delayed Effects) 


Same nozzle design and propellant 
dump system used as for other orbiter 
propellants. 


(Current Effects) 


Same as for Secondary Hazard (3) for 
Mission Phase (1) above. 


The Orbiter Personnel environmental 
central system is normally operating 
independently of the environment in 
the Cargo bay. There is an interface 
with the cargo bay environment though; 
Additional data is needed on the 
design of the orbiter crew environ- 
mental central system to see if there 
is a credible or improbable chance 
that toxic vapor in the cargo bay 
would be Injected into the crew cabin. 


Possible corrosion to the orbiter 
but less than the bore- line dump 
system because of the optimum 
location of the outlet and an 
optimum design of the nozzle. 

(Delayed Effects) 


Design system so that there can be 
no injestlon of toxic vapor into the 
orbiter cargo bay. 


Assumed the dump occurred after the last ones burn an 
the earliest possible opening of the cargo bay doors J 

Assumed the exit nozzle directs the F 2 gas/liquid at 
angle away from the orbiter. This means the orbiter! 
system will probably have to compensate for the for^ 
created. 


Same as the current effects except 
probably a lesser amount of 
corrosion due to the time available 
for dispersion of the F 2 gas. 


This hazard analysis does not consider the effects 0 
gas on the environment outside the shuttle and its e 
the earth environment or Its effect on other orbittr 
(other satellites) that may pass through the f ox1c| 


ORBITER PERSONNEL 


(Current Effects) 


(Delayed Effects) 








ANALYSIS FOR TASK 5 AND 6 
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SHUTTLE/MARINER PREFERRED SYSTEM 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
(9) 


RISK 

CATEGORY 

( 10 ) 


SAFETY 

CONTROLS & ASSUMPTIONS 

(ID 


REMARKS 

112 ) 


I (1) 

In the 
mcy 

i/C is 

bay 

structure) 
live over 
:he cargo 
ise exten- 
\ of the 
fvent 


illant 
r orbiter 


nmental 
perating 
ment In 
i nterface 
nt though: 
the 

nviron- 
if there 
chance 
a bay 
rew cabin. 


ORBITER 

(Current Effects) 

Same as for Secondary Hazard (2) 
above. 


(Delayed Effects) 

Same as for Oper. I, Mission Phase 
(1), secondary hazard I above. 


ORBITER PERSONNEL 
(Current Effects) 
No effect 


(Delayed Effects) 
No effect 


ORBITER 
(Current Effects) 

Possible corrosion to the orbiter 
but less than the bore-line dump 
system because of the optimum 
location of the outlet and an 
optimum design of the nozzle. 

(Delayed Effects) 

Same as the current effects except 
probably a lesser amount of 
corrosion due to the time available 
for dispersion of the F 2 gas. 


ORBITER PERSONNEL 
(Current Effects) 

No effect 


III 


III 


IV 


IV 


Same as for Secondary Hazard (1) 
and (2) above. 

Provide overpressure relief valve 
for the orbiter cargo bay. The 
normal vent system may be 
adequate. 


(Delayed Effects) 


No effect 


III 


III 


| 0 Same as for Secondary Hazard (?) for 
! Mission Phase (1) above. 

Design system so that there can be 
no injestion of toxic vapor Into the 
orbiter cargo bay. 


NOTE 1: The F 2 will be dumped <nto essentially a vacuum zero “g" 
condition will exist. The cargo bay atmosphere will be 
essentially a vacuum. The orbiter will be accelerating 
part of the time due to the OMS engine burn. The F;> 
gas will be vented under pressure. 


IV 


IV 


• Assumed the dump occurred after the last ones burn and beforr 
the earliest possible opening of the cargo bay doors. 

Assumed the exit nozzle d< sets the F 2 gas/liquid at a 90° 
angle away from the orbiter. This means the orbiter RCS 
system will probably have to compensate for the force vector 
created. 

This hazard analysis does not consider the effects of the F 2 
gas on the environment outside the shuttle and its effect on 
the earth environment or its effect on other orbiting objects 
(other satellites) that may pass through the toxic gas cloud. 
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POLDOIER 




FLIGHT SECONDARY HAZARD ANA 


SHUTTLE/HMUNER BASELINE SYSTEM 



MISSION 

HAZAROS (3) 

MAJOR CAUSES 

LIKELIHOOD OF 

HAZARD EFFECTS ON 
SHUTTLE ORBl TER 
(6) 

RISK 

SAFETY CONTRA 

OPERATION 

(1) 

PHASE 

(2) 

| PRIMARY 

SECONOARY 

" OF HAZARDS 

(4) 

HAZARD CAUSES 
(5) 

CATEGORIES 

(7) 

AND ASSUMPTia 
(6) | 

11 

Abort 
Opera t1or»s 
(Cont. 

A) RTLS 

Same as above 

Same 
hazards 
as tor 
Mission 
Phase I 

2) Hazardous LF? and F 2 
gas flowing from 
nozzle In conjunctior 
with other fuels, arid 
oxidizer vapors in 
the engine space and 
combustible by pro- 
ducts of the 
main engines. 

Same as for Oper. I 
Mission Phase (1), 
secondary hazard 
(3). Gas may enter 
the cargo bay by 
injection through 
the vent system. 

Credible chance that a 
significant corrosive 
nazard will exist for the 
external and Internal 
surfaces of the orblter 
due to injestlon of F 2 
gas through the vent 
system of the cargo bay. 

ORB I TER 

(Current Effects) 

0 Corrosion to external surfaces and 
possible injestlon Into the cargo bay 
causing corrosion and potential fires. 

0 Also possible burn through of the nozzle 
causing local damage to the orblter and 
possible rebore of an extensive amount 
of LF 2 into the main engine space 
which would cause an extensive amount 
of damage. 

HI. 

II possible 
I 

0 The design of the off 
the same as that indti 
Figure ( ) 

0 The outlet point and] 
the same as for the n 
hypergolic dump systa 







0 Reaction of other, hypergols with F 2 
left in dump system when other 
hypergols are dumped causing damage 
to the orblter. 









(Delayed Effects) 

II, 








0 Possible crash landing If a nozzle bum 
through occurs. If fuel vapor are 
Ignited, the damage will be very 
extensive possible causing destruction 
of the orbiter. The free liquid F 2 may 
eat through other fuel and oxidizer 
lines. 

I possible 








ORBIT PERSONNEL 









(Current and 
Delayed Effects) 

II, 

I possible 








0 Possible major injury or death if 
major damage occurs to the main engine 
space. 



1 

(ilorual) 

3) From earliest open- 
ing of cargo bay 
doors (T a 22 min) 
to planned or un- 
planned removal of 
payload from tne 
cargo bay. 

NOTE 1. 

Same as for 
Mission 
Phase I. 

A) Deploy S/C off-load 
mode. See Primary 
Hazard (TBD) in 
Mission Phase ( ) of 
Operation. 

B) r**!«p propellant off- 
load mode. 

1) LF? and gas 
and other'toxic 
by products 
escaping from the 
dump system into 
the orblter cargo 
bay or the main 

0 See primary 
hazard ( ) in 
Mission Phase ( ) 
of operations I 
and 11. 

0 Same as for 
Mission Phase (1) 
of operation I), 
Secondary hai-rd 
0). 

See primary hazard 
analysis phasn 3A. 

See primary hazard ( ), ( ) in Mfssion 
Phas* ( ) of Operation I and II. 

O'lBITER 

(Current Effects) 

Same as Mission Phase (1), Secondary 
Hazard (1) except that the damage to 
the cargo bay may be slightly less due 
to the doors being open thereby providing 
a means for disposal of toxic and 
corrosive gas. 

See primary 
hazard ( ), ( ) 
in Mission Phase 
( ) of Operation 
I and II. 

I! 

See primary hazard ( )9 
\ Phase ( ) of Operatic* 1 
that th,.~e is no mean® 
leaking tox.w ;*<t*s. 'M 




engine space. 

When in the 
vacuum and zero 
“g" condition the 
F 2 gas may stay 
in the cargo bay 
some time even 
with the doors 
open. It will 
take time for the 
gas to diffuse. 



(Delayed Effects) 

Minor additional corrosion damage 
1 the cargo bay and the main 
igine space and possible corroslai 
jf outside of orbiter {may cause 
etching of the astronaut view 
points). Lack of visibility may 
cause problems during reentry. 

ORBITER PERSONNEL 
(Current Effects) 

Ill, 

11 possible due 
to crack landing 
because of lack 
of visibility 
and failure of 
automatic landing 
system. 

0 Ass Limed that autcnatlj 
are provided in the oi 
sale landing can be ■ 

[ visibility occurs. .1 

i 0 Assumed there Is r x 
purge the cargo bay *1 
door are open 







If personnel* enter the area of the 
cargo bay when the toxic and 
corrosive gas hazard exists, the 
space suit may be damaged extensi- 
vely and their lives would be In 
jeopardy. The toxic gas concen- 
tration should be less during this 
phase than up to t+22 minutes. 

in. 

II possible 








(Delayed Effects) 









Injury may occur due to crash land- 
ing due to inadequate visibility 
during landing. 

II 








Effects on personnel In cargy bay 
about the same as for current 
effects. 

III 

I 

;■ / ,• ' ' 

1 



/ ORIGINAL PAGE 13 

OF POOR QUALITY 




ANALYSIS FOR TASK 5 AND 6 



(Delayed Effects) 

Same as for current effects except 
less because of lesser concen- 
tration of gas In the cargo bay. 
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(Delayed Effects) 

Possible fire trv the cargo bay as 
the orbiter enters the atmosphere. 
Also possible corrosion of cargo 
bay surfaces. 


Ill* 

II possible 
depending on 
the nozzles 
design and 
its location. 




SHUTTLE/MARINER PREFERRED SYSTEM 


CONTROLS 
SUMPTIONS 
( 8 ) 


the off-load system is 
it indicated in 

it and nozzle design is 
r the normal payload 
> system. 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
( 9 ) 


RISK 

CATEGORIES 

( 10 ) 


ORBITER 

(Current Effects) 

Possible corrosion of external 
surfaces because of reentry air 
and vapor distribution patterns. 
Possible injestion of vapors into 
cargo bay causing some corrosion. 
Possible local corrosion around 
nozzle depending on the nozzle 
design. Corrosive damage to crew 
view ports (windows) 


III, 

II possible 
depending on 
exit and 
nozzle 
design. 

NOTE 1, 


SAFETY 

CONTROLS A ASSUMPTIONS 

(11) 


o Independent dump system used for the 
F2 system, 

o See controls and assumptions 
indicated In Operation II A and 
secondary hazard (1). 

o Optimize the location of the exit 
point and the nozzle design for 
dumping during the normal mission 
and during the RTLS about made. 


REMARKS 

( 12 ) 


NOTE 1: The location of the nozzle and the nozzle's design may 
not be optimum from the corrosion to the orbiter point 
of view in the RTLS made when it is designed optimally 
from the damage point of view for the dump of Fj during 
the normal mis- ton phases. 


d ( ) , ( ) in Mission 
ation 1 and II assumed 
means to purge the 
es. 


HI, 

II possible 


S 2 G primary 
Mission 
Phase ( ) of 
Operation I 
and II. 


o Same as above. 

o Design of the dump system prevents 
significant reduction in visibility 
of astronaut view ports. 

o No personnel allowed in cargy bay area 
If corrosive and toxic gas level Is 
too high. 

o Shuttle has an effective F 2 toxic css 
detection system. 


A- 59 


ORBIT PERSONNEL 
(Current Effects) 


No injury to personnel. 

(Delayed Effects) 

Possible toxic gas hazard In the 
cargo bay after landing and 
possible residual Fg 1* the S/C 
oxidizer system and dump system 
after landing. 


See prir* / hazard ( ), { ) in 
Missis 'hase ( ) of Operation I 
and r . 


ORBITER 

(Current Effects) 

Possible corrosive damage to ma*n 
engine space and orbiter cargo bay 
but to a lesser extent than that 
required for the bore line dump 
system. 


(Delayed Effects) 

Minor corrosion to Orbiter but no 
corrosion of view points in crew 
area. Due to the design of the 
dump system the gas either went in 
on the windows or the 
concentration will be so low that 
visibility will not be impaired. 

ORBITER PERSONNEL 
(Current Effects) 

No effect for personnel not allowed 
In cargo bay If hazard exists. A 
II Is possible if personnel enter 
the area thinking the gas does not 
ex.'t and it does. 


IV, 

III possible 


See the primary hazard In Mission 
Phase (3A) of Operation I and II. 


Same as for Operation 
Secondary Hazard (1). 


, Mission Phase (1), 


NOTE 2: 


During this mission phase, the payload propellant may oe 
off-loaded oy removing the S/C from the orbiter or by 
dumping the propellant through the dump system. It Is 
assumed that the cargo bay doors will be opened when 
the propellant Is off-loaded through the dump system. 

There is no means ot dumping propellant when off loading 
the bore line design S/C. 

0 See primary hazard ( ) , ( ) in Mission Phase ( ) 
of Operation I and II. 


tomatic landing systems 
the orbiter so that a 
1 be made If loss of 
ps. 

» no means available to 
when the cargo bay 


IV, 

II possible. 


NOTE 1: 


1 


I 


i 


* 

r j 


OPERATION 

(1) 

MISSION 

PHASE 

(2) 

HAZARDS (3) 

MAJOR CAUSES 

LIKELIHOOD OF 
HAZARD CAUSES 
(5) 

HAZARD ! 

SHUTTE 

( 

PRIMARY 

SECONDARY 

OF HAZARDS 
(4) 

II 

Abort Oper- 
ations 
A) RTLS 

- 

The mission phases will 
consist of launch to 
MECO then landing. 

SRM's are ejected be- 
fore MECO. MECO occurs 
after the orbiter is 
heading back to the 
launch base at 
t = 561 sec. or 9.35 
min. The last part of 
MECO consists of 
dumping the LOX and 
LH2 in the external 
tank. After MECO 
the tank is ejected 
then the orbiter comes 
in for a landing. In 
these mission phases 
the maximum attitude 
achieved is approxi- 
mately 55 nautical 
mi 1 es . 

NOTE 1. 

Same 

hazards as 
for 

Mission 
Phase I. 

NOTE 2: The main 
secondary hazards are: 

1) Explosive reactions 
in the off-load 
system. 

Same as for Oper. I, 
Mission Phase (1), 
secondary hazard 

(a). 

1 

Same as for Oper. I, 
Mission Phase (1), 
secondary hazard (2), 
except as indicated below. 

The chance of these 
hazards occurring are 
greater than for normal 
flight because of extra 
forces being applied in 
other than nominal 
direction; the chance of 
a crack or leak occurring 
is greater. 

i 

(Current 

Same as for Operj 
secondary hazard \ 

(Delayed 

Due to extent dami 
phase, the orbtie 1 
enter into laterrj 

ORBITER :1 
(Current and [ 

Probable loss of J 
inability to perft 






Fm.DOUT ) 


FLIGHT SECONDARY HAZARD ANALYSIS FOR TASK 5 AND 6 


SHUTTLE/MARINER BASELINE SYSTEM 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
( 6 ) 


RISK 

CATEGORIES 

( 7 ) 


SAFETY CONTROLS 
AND ASSUMPTIONS 
( 8 ) 


HAZARD EFFECTS ON 
SHUTTLE ORBITER 
( 9 ) 


SHUTTLE/MARINER PREFERRED SYSTEM 


RISK 

CATEGORY I CONTROU 

(10) 1 1 


ORBITER 

(Current Effects) 

or Oper. I, Mission Ph^.e ( 1 ), 
hazard ( 2 ). 


(Delayed Effects) 

tent damage in first mission 
e orbtier probably will not 
o later-mission phase. 


ORBITER PERSONNEL 


o See Figure (TBD) for baseline design 
assumed. 

o Provide ?2 space suits for ground 
personnel at primary and secondary 
landing sites. 

o Provide F 2 detection system at primary j 
and secondary landing sites during 
the time an F2 payload is flown. 

0 Provide extensive training for ground 
personnel in handling of F2 systems, 
and problems under accident conditions. 


ORBITER 

(Current Effects) 

Same as for Operation I* Mission 
Phase ( 1 ), secondary hazard ( 2 ). 


(Delayed Effects) 

Possible extensive corrosion 
damage to the engine space and 
possibly fire and possibly cause 
of explosion in the engine space 
because of fuel vapor and oxi- 
dizer vapors resulting from dump- 
ing TST and other propellants 
upon reentry. The above will 
occur only if leaks in the dump 
system result from the Internal 
explosion. 

ORBITER PERSONNEL 


III* 

II possible 
(slightly 
more likely 
than for 
normal flight) 

II, 

I (possible 
because of the 
cost of 
damage to the 
main engine 
space.) 


0 Same as requi 
Mission Phas< 
( 2 ) and (1)J 

0 Design the Fj 
to withstand] 
without leaks 

0 One design ob 
eliminate the 
explosives in 
could be accd 
that there is 
in a million] 
of contaminan 
to cause an e 

0 Provide F2 ga 
personnel at \ 
landing sites 
flown. 

0 Also provide i 
suits to groil 
suits for orb 
primary and si 


ent and Delayed Effects) 

loss of crew due to 
to perform RTLS. 


(Current Effects) 

No immediate effects on personnel. 


IV 


(Delayed Effects) 

Possible crash landing resulting 
from damage to main engine space 
but not likely. If as a result of 
damage to the dump system, F2 gas 
or liquid still remains in the 
system a significant toxic gas or 
liquid fire and corrosive hazard 
will be presented to ground and 
orbiter personnel and the orbiter 
once the orbiter has landed. 


HI, 

II possible 


0 Provide extenj 
ground person] 
systems and pi 
conditions. 9 

0 Provide means? 
purge the carj 
nitrogen befoi 
bay 
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SHUTTLE /'MARINER PREFERRED SYSTEM 


ON 

RISK 

ER 

CATEGORY 1 


no) 

:s) 

in 1 , Mission 

hi. 

• hazard ( 2 ). 

II possible 
(slightly 
more likely 


than fcr 
normal flight) 

is) 

Ht 


I (possible 
because of the 
cost of 
damage to the 
main engine 
I space.) 


on personnel . I IV 


ing resulting 
engine space 
as a result of 
system, F2 gas 
5i ns in the 
b toxic gas or 
rosive hazard 
3 ground and 
nd the orbiter 
s landed. 


HI, 

II possible 


SAFETY 

CONTROLS & ASSUMPTIONS 

(ID 


0 Same as required for Operation I, 
Mission Phase ( 1 ), secondary hazard 
( 2 ) and ( 1 ). 

0 Design the F 2 dump system to be able 
to withstand low order explosions 
without leaks in the system. 

0 One design objective would be to 
eliminate the possibility of low order 
explosives in the dump system. This 
could be accomplished by assuring 
that there is less than one chance 
in a million that a suffiv '‘ent amount 
of contaminants would be in che system 
to cause an explosion. 

0 Provide F2 gas detectors to ground 
personnel at primary and secondary 
landing sites when an F2 system is 
flown. 

0 Also provide F? compatible space 
suits to ground personnel and provide 
suits for orbiter personnel at the 
primary and secondary landing sites. 

0 Provide extensive training, for 
ground personnel in handling of F2 
systems and problems under accident 
conditions. 

0 Provide means at the landing sites to 
pur the cargo bay with clear dry 
nitrogen before entering the cargo 
bay 



REMARKS 

( 12 ) 
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Only the dump off-load mode can be achieved during this 
operation. 


NOTE 1 : The "g* forces will be large in relation to the normal 
"g" forces and will be applied to the payload along 
different force vectors than normal. 


NOTE 2 : It is assumed that the oxidizer payload will be dumped 

during main engine burn once it is known that RTLS is 
required. The oxidizer will be dumped after SRM 
separation. It is also assumed that F2 will be 
dumped before other hypergols. 



